PT-2022-6637 · Cisco · Cisco Roomos+1

Jason Crowder + 1 · Published 2022-10-19 · Updated 2022-10-31 · CVE-2022-20811

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software (affected versions not specified) Cisco RoomOS Software (affected versions not specified)

Description The issue is related to insufficient input validation in the implementation of the application programming interface of the Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS software. This could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device.

Recommendations For Cisco TelePresence Collaboration Endpoint (CE) Software, consider restricting access to sensitive data and files until a patch is available. For Cisco RoomOS Software, as a temporary workaround, consider disabling any functionality that allows writing arbitrary files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

BDU:2023-02983

CVE-2022-20811

Affected Products

Cisco Roomos

Cisco Telepresence Collaboration Endpoint (Ce)

References · 5

• https://osv.dev/vulnerability/CVE-2022-20811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20811 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02983 · Security Note
• https://t.me/cibsecurity/52113 · Telegram Post