20221019 Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by a vulnerability in the video endpoint xAPI of Cisco TelePresence CE that could allow an authenticated, local attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the device and escalate privileges from admin to root. To exploit this vulnerability, an attacker would need to have an Administrator account.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2022-20776

medium

Tenable Plugins

medium