cisco-sa-expressway-overwrite-3buqW8LH: Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities
First published: Wed Jul 06 2022(Updated: )
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected
Credit: CVE-2022-20812 was found during internal security testing by Jason Crowder the Cisco Advanced Security Initiatives GroupCVE-2022-20813 was found during internal security testing by Deklan Evans the Cisco ASIG
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Expressway Series | >=.0<14<=14.0<14.31 (late Apr 2023) | 14.31 (late Apr 2023) |
| Cisco TelePresence VCS | >=.0<14<=14.0<14.31 (late Apr 2023) | 14.31 (late Apr 2023) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-expressway-overwrite-3buqW8LH?
The severity of cisco-sa-expressway-overwrite-3buqW8LH is critical with a CVSS score of 9.
How can a remote attacker exploit cisco-sa-expressway-overwrite-3buqW8LH vulnerability?
A remote attacker can exploit cisco-sa-expressway-overwrite-3buqW8LH by overwriting arbitrary files or conducting null byte poisoning attacks on an affected device.
Which Cisco products are affected by cisco-sa-expressway-overwrite-3buqW8LH vulnerability?
The Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) are affected by cisco-sa-expressway-overwrite-3buqW8LH vulnerability.
How do I fix cisco-sa-expressway-overwrite-3buqW8LH vulnerability?
To fix cisco-sa-expressway-overwrite-3buqW8LH vulnerability, update the affected devices to Cisco Expressway Series version 14.31 (late Apr 2023) or later.
What is CWE-36?
CWE-36 refers to a null byte poisoning vulnerability.
- collector/cisco-recent
- agent/weakness
- agent/type
- agent/event
- agent/references
- agent/title
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco expressway series
- version/cisco expressway series/.0
- version/cisco expressway series/14.0
- canonical/cisco telepresence vcs
- version/cisco telepresence vcs/.0
- version/cisco telepresence vcs/14.0