CVE-2023-20091: Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite Vulnerability
First published: Fri Nov 15 2024(Updated: )
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. This vulnerability is due to improper access controls on files that are on the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit this vulnerability, an attacker would need to have a remote support user account. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Collaboration Endpoint Software | ||
| Cisco RoomOS Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-20091?
CVE-2023-20091 has a high severity due to the potential for an authenticated attacker to overwrite arbitrary files on affected devices.
How do I fix CVE-2023-20091?
To mitigate CVE-2023-20091, ensure you update your Cisco TelePresence CE or RoomOS to the latest patched version provided by Cisco.
Who is affected by CVE-2023-20091?
CVE-2023-20091 affects users of Cisco TelePresence CE and Cisco RoomOS who are running vulnerable versions.
What types of attacks can exploit CVE-2023-20091?
Authenticated, local attackers can exploit CVE-2023-20091 to overwrite files on the local file system of affected devices.
What are the potential impacts of CVE-2023-20091?
Exploitation of CVE-2023-20091 can lead to unauthorized file modification, compromising device integrity and functionality.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco telepresence collaboration endpoint software
- canonical/cisco roomos software