CVE-2019-15273
published 2019-10-16CVE-2019-15273: Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite…
PriorityP422medium4.4CVSS 3.1
AVLACLPRHUINSUCNIHAN
EPSS
0.27%
18.8th percentile
Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_telepresence_tc_software | >= unspecified < n/a | n/a |
| cisco | telepresence_collaboration_endpoint | < 9.8.1 | 9.8.1 |
| cisco | telepresence_collaboration_endpoint | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv3.06.0MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
nvdv2.06.6MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:C
vendor_cisco6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
vendor_cisco·2019-10-16·CVSS 6.0
CVE-2019-15273 [MEDIUM] CWE-20 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files.
The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS).
Cisco has released software
Cisco
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
vendor_cisco·CVSS 3.0
CVE-2019-15273 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
CVE-2019-15273: Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS). Cisco has rel
GHSA
GHSA-8v75-pxmp-2vx3: Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwri
ghsa_unreviewed·2022-05-24
CVE-2019-15273 [MEDIUM] CWE-20 GHSA-8v75-pxmp-2vx3: Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwri
Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-10-16
Published