CVE-2018-15430

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.2HIGH

EPSS

1.6%

top 18.43%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Cisco Telepresence Video Communication Server (vcs)Cisco Telepresence Video Communication Server

Timeline

PublishedOct 5

Latest updateMay 13

Description

A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful expl…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/telepresence_video_communication_serverx7.2.4, x8.10.4, x8.9.2+2

▶CVEListV5cisco/cisco_telepresence_video_communication_server_(vcs)n/a

🔴Vulnerability Details

GHSA

GHSA-gv37-765c-v9fx: A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an↗2022-05-13

▶

CVEList

Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability↗2018-10-05

▶

📋Vendor Advisories

Cisco

Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability↗2018-10-03

▶