CVE-2021-34715

CWE-3474 documents4 sources
Severity
7.2HIGH
EPSS
0.7%
top 28.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco ExpresswayCisco Telepresence Video Communication ServerCisco Cisco Telepresence Video Communication Server (vcs) Expressway
Timeline
PublishedAug 18
Latest updateMay 24

Description

A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful ex…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LExploitability: 1.2 | Impact: 3.4

Affected Packages3 packages

▶NVDcisco/expresswayx8.8.0

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p7w3-xcqr-pr4r: A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an a↗2022-05-24
▶
CVEList
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability↗2021-08-18
▶

📋Vendor Advisories

1
Cisco
Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability↗2021-08-18
▶
CVE-2021-34715 (HIGH CVSS 7.2) | A vulnerability in the image verifi | cvebase.io