6.6

CVE-2019-15962

Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An attacker could exploit this vulnerability by logging in as the remotesupport user and writing files to the /root directory of an affected device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Telepresence Collaboration Endpoint Version 7.3.18
   Cisco ≫ Webex Board 55 Version -
   Cisco ≫ Webex Board 55s Version -
   Cisco ≫ Webex Board 70 Version -
   Cisco ≫ Webex Board 70s Version -
   Cisco ≫ Webex Board 85s Version -
   Cisco ≫ Webex Room 55 Version -
   Cisco ≫ Webex Room 55 Dual Version -
   Cisco ≫ Webex Room 70 Dual Version -
   Cisco ≫ Webex Room 70 Dual G2 Version -
   Cisco ≫ Webex Room 70 Single Version -
   Cisco ≫ Webex Room 70 Single G2 Version -
   Cisco ≫ Webex Room Kit Version -
   Cisco ≫ Webex Room Kit Mini Version -
Cisco ≫ Telepresence Collaboration Endpoint Version 8.3.7
   Cisco ≫ Webex Board 55 Version -
   Cisco ≫ Webex Board 55s Version -
   Cisco ≫ Webex Board 70 Version -
   Cisco ≫ Webex Board 70s Version -
   Cisco ≫ Webex Board 85s Version -
   Cisco ≫ Webex Room 55 Version -
   Cisco ≫ Webex Room 55 Dual Version -
   Cisco ≫ Webex Room 70 Dual Version -
   Cisco ≫ Webex Room 70 Dual G2 Version -
   Cisco ≫ Webex Room 70 Single Version -
   Cisco ≫ Webex Room 70 Single G2 Version -
   Cisco ≫ Webex Room Kit Version -
   Cisco ≫ Webex Room Kit Mini Version -
Cisco ≫ Telepresence Collaboration Endpoint Version 9.6.4
   Cisco ≫ Webex Board 55 Version -
   Cisco ≫ Webex Board 55s Version -
   Cisco ≫ Webex Board 70 Version -
   Cisco ≫ Webex Board 70s Version -
   Cisco ≫ Webex Board 85s Version -
   Cisco ≫ Webex Room 55 Version -
   Cisco ≫ Webex Room 55 Dual Version -
   Cisco ≫ Webex Room 70 Dual Version -
   Cisco ≫ Webex Room 70 Dual G2 Version -
   Cisco ≫ Webex Room 70 Single Version -
   Cisco ≫ Webex Room 70 Single G2 Version -
   Cisco ≫ Webex Room Kit Version -
   Cisco ≫ Webex Room Kit Mini Version -
Cisco ≫ Telepresence Collaboration Endpoint Version 9.7.2
   Cisco ≫ Webex Board 55 Version -
   Cisco ≫ Webex Board 55s Version -
   Cisco ≫ Webex Board 70 Version -
   Cisco ≫ Webex Board 70s Version -
   Cisco ≫ Webex Board 85s Version -
   Cisco ≫ Webex Room 55 Version -
   Cisco ≫ Webex Room 55 Dual Version -
   Cisco ≫ Webex Room 70 Dual Version -
   Cisco ≫ Webex Room 70 Dual G2 Version -
   Cisco ≫ Webex Room 70 Single Version -
   Cisco ≫ Webex Room 70 Single G2 Version -
   Cisco ≫ Webex Room Kit Version -
   Cisco ≫ Webex Room Kit Mini Version -
Cisco ≫ Telepresence Collaboration Endpoint Version 9.8.0
   Cisco ≫ Webex Board 55 Version -
   Cisco ≫ Webex Board 55s Version -
   Cisco ≫ Webex Board 70 Version -
   Cisco ≫ Webex Board 70s Version -
   Cisco ≫ Webex Board 85s Version -
   Cisco ≫ Webex Room 55 Version -
   Cisco ≫ Webex Room 55 Dual Version -
   Cisco ≫ Webex Room 70 Dual Version -
   Cisco ≫ Webex Room 70 Dual G2 Version -
   Cisco ≫ Webex Room 70 Single Version -
   Cisco ≫ Webex Room 70 Single G2 Version -
   Cisco ≫ Webex Room Kit Version -
   Cisco ≫ Webex Room Kit Mini Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.167
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.4 0.8 3.6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
NIST 6.6 3.9 9.2
AV:L/AC:L/Au:N/C:N/I:C/A:C
Cisco PSIRT 4.4 0.8 3.6
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite
Vendor Advisory