Cisco TelePresence CE Path Traversal (cisco-sa-roomos-trav-beFvCcyu) (CSCwc21962)

medium Nessus Plugin ID 166374


The remote device is missing a vendor-supplied security patch.


According to its self-reported version, Cisco TelePresence Collaboration Endpoint Software is affected by a vulnerability in the video endpoint xAPI of Cisco TelePresence CE that could allow an authenticated, local attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the device and escalate privileges from admin to root. To exploit this vulnerability, an attacker would need to have an Administrator account.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwc21962

See Also

Plugin Details

Severity: Medium

ID: 166374

File Name: cisco-sa-roomos-trav-beFvCcyu-CVE-2022-20776.nasl

Version: 1.6

Type: remote

Family: CISCO

Published: 10/21/2022

Updated: 5/2/2023

Supported Sensors: Nessus

Risk Information


Risk Factor: Medium

Score: 5.9


Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2022-20776


Risk Factor: Medium

Base Score: 6.7

Temporal Score: 5.8

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:telepresence_collaboration_endpoint

Required KB Items: Cisco/TelePresence_MCU/Device, Cisco/TelePresence_MCU/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2022

Vulnerability Publication Date: 10/19/2022

Reference Information

CVE: CVE-2022-20776

CISCO-SA: cisco-sa-roomos-trav-beFvCcyu

IAVA: 2022-A-0439-S