PT-2022-5341 · Cisco · Cisco Roomos+1

Jason Crowder · Published 2022-10-19 · Updated 2022-10-31 · CVE-2022-20776

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description The issue is related to incorrect directory path restriction in the xAPI component of the Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software. This could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device by exploiting the vulnerability with a specially crafted request and an active Administrator account.

Recommendations For Cisco TelePresence Collaboration Endpoint (CE) Software, consider restricting access to the xAPI component until a patch is available. For Cisco RoomOS Software, consider disabling the xAPI component temporarily to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

CWE-21

Related Identifiers

BDU:2022-06655

CVE-2022-20776

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 7

• https://bdu.fstec.ru/vul/2022-06655 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20776 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20776 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu · Note
• https://t.me/cibsecurity/52109 · Telegram Post
• https://vuldb.com/?id.211787 · Note