Cisco Telepresence System Software vulnerabilities

CVE-2014-3362 [HIGH] CWE-399 CVE-2014-3362: Memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote a Memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote attackers to cause a denial of service (management outage) via multiple TELNET connections, aka Bug ID CSCuo63677.

CVE-2014-3274 [MEDIUM] CWE-310 CVE-2014-3274: Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS session Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, aka Bug ID CSCuj26326.

CVE-2014-2156 [HIGH] CWE-20 CVE-2014-2156: Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denia Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45739.

CVE-2014-2161 [HIGH] CWE-20 CVE-2014-2161: The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote att The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45731.

CVE-2014-2160 [HIGH] CWE-20 CVE-2014-2160: The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote att The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCty45745.

CVE-2014-2158 [HIGH] CWE-20 CVE-2014-2158: Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denia Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720.

CVE-2014-2157 [HIGH] CWE-20 CVE-2014-2157: Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denia Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45733.

CVE-2014-2159 [HIGH] CWE-20 CVE-2014-2159: The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote att The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka Bug ID CSCtq78722.

CVE-2014-0661 [HIGH] CWE-94 CVE-2014-0661: The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3 The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.

CVE-2013-3454 [CRITICAL] CWE-255 CVE-2013-3454: Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, an Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which makes it easier for remote attackers to modify the configuration or perform arbitrary actions via HTTPS requests, aka Bug ID CSCui43128.

CVE-2012-3075 [CRITICAL] CWE-78 CVE-2012-3075: The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allow The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.

CVE-2012-2486 [HIGH] CWE-94 CVE-2012-2486: The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9 The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoint Devices before 1.9.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server before 1.8.1 allows remote attackers to execute arbitrary code by leveraging certain adjacency and sending a ma

CVE-2012-3073 [HIGH] CVE-2012-3073: The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manag The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server 1.8 and earlier allows remote attackers to cause a denial of service (networking outage or process crash) via (1) malformed IP packets, (2) a high rate of TCP connection requests, or (3) a high rate of TCP

CVE-2012-3074 [HIGH] CWE-78 CVE-2012-3074: An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attac An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.

CVE-2012-0331 [HIGH] CWE-399 CVE-2012-0331: Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319.

CVE-2012-0330 [HIGH] CWE-399 CVE-2012-0330: Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a malformed SIP message, aka Bug ID CSCtr20426.

CVE-2011-0373 [CRITICAL] CWE-78 CVE-2011-0373: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allo The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31685.

CVE-2011-0375 [CRITICAL] CWE-78 CVE-2011-0375: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allo The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCth24671.

CVE-2011-0372 [CRITICAL] CWE-78 CVE-2011-0372: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allo The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31640.

CVE-2011-0376 [CRITICAL] CWE-200 CVE-2011-0376: The TFTP implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x, 1. The TFTP implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x, 1.6.0, and 1.6.1 allows remote attackers to obtain sensitive information via a GET request, aka Bug ID CSCte43876.