CVE-2019-15962 — Incorrect Default Permissions in Cisco Telepresence TC Software

CWE-275CWE-276 — Incorrect Default Permissions4 documents4 sources
Severity
4.4MEDIUMNVD
EPSS
0.2%
top 63.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Telepresence TC SoftwareCisco Telepresence Collaboration Endpoint
Timeline
PublishedOct 16
Latest updateMay 24

Description

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An attacker could exploit this vulnerability by logging in as the remotesupport user and writing files to the /root directory of an affected device.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitability: 0.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5cisco/cisco_telepresence_tc_softwareunspecified — n/a

🔴Vulnerability Details

2
GHSA
GHSA-47pc-xw4x-49cm: A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to t↗2022-05-24
▶
CVEList
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability↗2019-10-16
▶

📋Vendor Advisories

1
Cisco
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability↗2019-10-16
▶
CVE-2019-15962 — Incorrect Default Permissions in Cisco | cvebase