CVE-2015-4328
published 2015-08-20CVE-2015-4328: Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote…
PriorityP428medium4CVSS 2.0
AVNACLAuSCNIPAN
EPSS
1.98%
78.2th percentile
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | telepresence_video_communication_server_software | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability
vendor_cisco·2015-08-18·CVSS 4.0
CVE-2015-4328 [MEDIUM] CWE-20 Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability
Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability
A vulnerability in the web framework of the Cisco TelePresence Video Communication Server (VCS) Expressway could allow an authenticated, remote attacker to execute commands on the underlying operating system.
The vulnerability is due to improper authorization of read-only users. An attacker could exploit this vulnerability by submitting crafted HTTP requests to the affected device. An exploit could allow the attacker to modify existing entries or add new entries in the Unified Communications lookup page.
Cisco has confirmed the vulnerability; however, software updates are not available.
An authenticated, remote attacker could utilize this vulnerability by sending crafted HTTP requests to the targe
GHSA
GHSA-565h-f96p-rpm8: Cisco TelePresence Video Communication Server (VCS) Expressway X8
ghsa_unreviewed·2022-05-17
CVE-2015-4328 [MEDIUM] CWE-20 GHSA-565h-f96p-rpm8: Cisco TelePresence Video Communication Server (VCS) Expressway X8
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-08-20
Published