cisco-sa-20191016-tele-ce-cmdinj: Cisco TelePresence Collaboration Endpoint Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injections. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating as an administrative level user within the restricted shell and submitting malicious input to a specific command. A successful exploit could allow the attacker to execute previously staged code from the underlying filesystem. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-cmdinj
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20191016-tele-ce-cmdinj?
The severity of cisco-sa-20191016-tele-ce-cmdinj is considered high due to the potential for command injection by authenticated attackers.
How do I fix cisco-sa-20191016-tele-ce-cmdinj?
To fix cisco-sa-20191016-tele-ce-cmdinj, update your Cisco TelePresence Collaboration Endpoint to the latest patched version provided by Cisco.
Who is affected by cisco-sa-20191016-tele-ce-cmdinj?
Cisco TelePresence Collaboration Endpoint users with vulnerable versions are affected by cisco-sa-20191016-tele-ce-cmdinj.
What causes the cisco-sa-20191016-tele-ce-cmdinj vulnerability?
The cisco-sa-20191016-tele-ce-cmdinj vulnerability is caused by insufficient input validation in the CLI of the affected Cisco software.
Can the cisco-sa-20191016-tele-ce-cmdinj vulnerability be exploited remotely?
No, the cisco-sa-20191016-tele-ce-cmdinj vulnerability requires local authentication for exploitation.