CVE-2019-1720 — Improper Input Validation in Cisco Telepresence Video Communication Server

CWE-20 — Improper Input Validation4 documents4 sources
Severity
4.9MEDIUMNVD
CNA6.8
EPSS
0.3%
top 45.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Telepresence Video Communication ServerCisco Telepresence Video Communication Server
Timeline
PublishedApr 18
Latest updateMay 13

Description

A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a specifically crafted XML payload. A successful exploit could allow the attacker to exhaust CPU resour…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5cisco/cisco_telepresence_video_communication_serverunspecified — X12.5.1

🔴Vulnerability Details

2
GHSA
GHSA-w82q-5jhx-c75p: A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote↗2022-05-13
▶
CVEList
Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service Vulnerability↗2019-04-18
▶

📋Vendor Advisories

1
Cisco
Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service Vulnerability↗2019-04-17
▶