CVE-2019-1878: A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow…

PriorityP351high8.8CVSS 3.0

AVAACLPRNUINSUCHIHAH

EPSS

1.08%

61.2th percentile

A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insufficient input validation of received CDP packets. An attacker could exploit this vulnerability by sending crafted CDP packets to an affected device. A successful exploit could allow the attacker to execute arbitrary shell commands or scripts on the targeted device.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_telepresence_tc_software	>= unspecified < 9.7.1	9.7.1
cisco	telepresence_ce	>= 8.0.0 < 8.3.7	8.3.7
cisco	telepresence_ce	>= 9.1.0 < 9.5.3	9.5.3
cisco	telepresence_ce	>= 9.6.0 < 9.6.3	9.6.3
cisco	telepresence_endpoint	—	—
cisco	telepresence_tc	>= 7.0.0 < 7.3.17	7.3.17

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C

vendor_cisco7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.