CVE-2019-15274
Medium
Description
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injections. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating as an administrative level user within the restricted shell and submitting malicious input to a specific command. A successful exploit could allow the attacker to execute previously staged code from the underlying filesystem.
SeverityMedium
CVSS6.7
Exploit probability—
Product
Cisco Telepresence Collaboration Endpoint
PublishedOct 16, 2019
First seenOct 16, 2019
Weakness typeCWE-78OS command injection
How to fix
Update
- cisco telepresence_collaboration_endpoint9.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco telepresence_collaboration_endpoint | v < 9.8.1 | 9.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.