CVE-2015-0653
Critical
Description
The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.
SeverityCritical
CVSS10.0
Exploit probability—
Product
Cisco Expressway Software
PublishedMar 13, 2015
First seenMar 13, 2015
How to fix
Update
- cisco expressway_softwarex7.2.4, x8.1.2, x8.2.2 or later
- cisco telepresence_conductorx2.3.1, xc2.4.1 or later
- cisco telepresence_video_communication_server_softwarex7.2.4, x8.1.2, x8.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco expressway_software | x7.2 ≤ v < x7.2.4, x8.1 ≤ v < x8.1.2, x8.2 ≤ v < x8.2.2 | x7.2.4, x8.1.2, x8.2.2 |
| cisco telepresence_conductor | x2.3 ≤ v < x2.3.1, xc2.4 ≤ v < xc2.4.1 | x2.3.1, xc2.4.1 |
| cisco telepresence_video_communication_server_software | x7.2 ≤ v < x7.2.4, x8.1 ≤ v < x8.1.2, x8.2 ≤ v < x8.2.2 | x7.2.4, x8.1.2, x8.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.