CVE-2021-34715
published 2021-08-18CVE-2021-34715: A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an…
PriorityP344high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.06%
60.7th percentile
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_telepresence_video_communication_server_expressway | — | — |
| cisco | expressway | <= x8.8.0 | — |
| cisco | expressway_series_and_telepresence_video_communication_server_image_verification | — | — |
| cisco | telepresence_video_communication_server | <= x8.8 | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
vendor_cisco·2021-08-18·CVSS 4.7
CVE-2021-34715 [MEDIUM] CWE-347 Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system.
The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system.
Cisco has released software updates that address this vulnerabili
Cisco
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-34715 Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
CVE-2021-34715: Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system. Cisco has released software updates that address th
GHSA
GHSA-p7w3-xcqr-pr4r: A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an a
ghsa_unreviewed·2022-05-24
CVE-2021-34715 [HIGH] CWE-347 GHSA-p7w3-xcqr-pr4r: A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an a
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-08-18
Published