Detections
Analytics
Cisco TelePresence Management Suite Simple Object Access Protocol Vulnerability
medium Nessus Plugin ID 129947
Language:
Synopsis
The remote host is missing a vendor-supplied security patchDescription
A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.The vulnerability is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this vulnerability by gaining access to internal, trusted networks to send crafted SOAP calls to the affected device. If successful, an exploit could allow the attacker to access system management tools. Under normal circumstances, this access should be prohibited.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvj25332See Also
Plugin Details
Severity: Medium
ID: 129947
File Name: cisco-sa-20190206-tms-soap.nasl
Version: 1.3
Type: combined
Agent: windows
Family: Windows
Published: 10/15/2019
Updated: 4/11/2022
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 1.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2019-1660
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:telepresence_management_suite
Required KB Items: Settings/ParanoidReport, installed_sw/Cisco Telepresence Management Suite
Exploit Ease: No known exploits are available
Patch Publication Date: 2/6/2019
Vulnerability Publication Date: 2/6/2019
Reference Information
CVE: CVE-2019-1660
BID: 106918