CVE-2023-20093: Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite Vulnerability
First published: Fri Nov 15 2024(Updated: )
Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account. Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Collaboration Endpoint Software | ||
| Cisco RoomOS Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-20093?
CVE-2023-20093 is rated as high severity due to its potential for arbitrary file overwrite by an authenticated local attacker.
How does CVE-2023-20093 affect Cisco TelePresence Collaboration Endpoint?
CVE-2023-20093 affects Cisco TelePresence Collaboration Endpoint by allowing authenticated local attackers to overwrite files due to improper access controls.
How do I fix CVE-2023-20093?
To fix CVE-2023-20093, update your Cisco TelePresence Collaboration Endpoint or RoomOS to the latest version that addresses this vulnerability.
What should I do if I suspect exploitation of CVE-2023-20093?
If you suspect exploitation of CVE-2023-20093, immediately check for unauthorized file changes and apply the necessary updates to your affected devices.
Are there any workarounds for CVE-2023-20093?
Currently, there are no documented workarounds for CVE-2023-20093, so applying the patch is recommended.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco telepresence collaboration endpoint software
- canonical/cisco roomos software