PT-2022-5343 · Cisco · Cisco Roomos+1

Jason Crowder · Published 2022-10-19 · Updated 2022-10-31 · CVE-2022-20954

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the software, including a command-line interface (CLI) vulnerability associated with symbolic link handling errors in the Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS. This could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device.

Recommendations For Cisco TelePresence Collaboration Endpoint (CE) Software, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco RoomOS Software, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Path traversal

Information Disclosure

Link Following

Weakness Enumeration

CWE-284

CWE-22

CWE-200

CWE-59

Related Identifiers

BDU:2022-06657

CVE-2022-20954

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 7

• https://bdu.fstec.ru/vul/2022-06657 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20954 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20954 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu · Note
• https://cybersecurity-help.cz/vdb/SB2022102068 · Note
• https://t.me/cibsecurity/52106 · Telegram Post