PT-2023-4589 · Cisco · Cisco Expressway Series+1

Sean Morland

·

Published

2023-08-16

·

Updated

2024-01-25

·

CVE-2023-20209

CVSS v2.0

7.7

High

VectorAV:N/AC:L/Au:M/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) version 14.0
Description A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) exists due to insufficient validation of user-supplied input. This could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack, resulting in remote code execution on an affected device. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges.
Recommendations For Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) version 14.0, consider disabling the web-based management interface until a patch is available. Restrict access to the management interface to minimize the risk of exploitation. Avoid using the interface for any critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Command Injection

OS Command Injection

Code Injection

Weakness Enumeration

CWE-77CWE-78CWE-94

Related Identifiers

BDU:2023-04996
CVE-2023-20209

Affected Products

Cisco Expressway Series
Cisco Telepresence Video Communication Server