CVE-2023-20004: Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Write Vulnerability
First published: Fri Nov 15 2024(Updated: )
Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account. Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Collaboration Endpoint Software | ||
| Cisco RoomOS Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-20004?
CVE-2023-20004 has been classified with a high severity rating due to its potential to allow file overwriting by an authenticated local attacker.
How do I fix CVE-2023-20004?
To fix CVE-2023-20004, it is recommended to install the latest security updates provided by Cisco for the affected software versions.
Who is affected by CVE-2023-20004?
CVE-2023-20004 affects users of Cisco TelePresence Collaboration Endpoint and Cisco RoomOS who have not updated their devices.
What types of attacks can exploit CVE-2023-20004?
CVE-2023-20004 can be exploited by an authenticated local attacker to overwrite arbitrary files on the affected device.
What are the potential impacts of CVE-2023-20004?
The potential impacts of CVE-2023-20004 include unauthorized modification of system files, leading to a compromise of device integrity.
- agent/references
- agent/title
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco telepresence collaboration endpoint software
- canonical/cisco roomos software