CVE-2021-34716

CWE-460 CWE-755 — Improper Exception Handling4 documents4 sources

Severity

7.2HIGH

EPSS

1.1%

top 21.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Expressway Cisco Telepresence Video Communication Server Cisco Cisco Telepresence Video Communication Server (vcs) Expressway

Timeline

PublishedAug 18

Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then u…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:LExploitability: 1.2 | Impact: 5.5

Affected Packages3 packages

▶CVEListV5cisco/cisco_telepresence_video_communication_server_(vcs)_expresswayn/a

▶NVDcisco/telepresence_video_communication_serverx8.6 — x14.0.3

▶NVDcisco/expresswayx8.6.0 — x14.1

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

GHSA

GHSA-9mxr-mcvr-5xpm: A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a↗2022-05-24

▶

CVEList

Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability↗2021-08-18

▶

📋Vendor Advisories

Cisco

Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability↗2021-08-18

▶