Cisco TelePresence endpoints running either CE or TC software contain a vulnerability that could allow an authenticated, local attacker to e

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco telepresence tc software7.1.0
• cisco telepresence tc software7.1.1
• cisco telepresence tc software7.1.2
• cisco telepresence tc software7.1.3
• cisco telepresence tc software7.1.4
• cisco telepresence tc software7.3.0
• cisco telepresence tc software7.3.1
• cisco telepresence tc software7.3.2
• cisco telepresence tc software7.3.3
• cisco telepresence tc software8.0.0
• cisco telepresence tc software8.1.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (cisco). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Cisco TelePresence CE and TC 8.1.x

  • Cisco TelePresence CE and TC 8.1.xaffected

Other highest-scoring records for the same primary product.

• CVE-2016-1387The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0
  40Plan
• CVE-2014-2169Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrar
  37Monitor
• CVE-2014-2174Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attacker
  33Monitor
• CVE-2013-3379The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allo
  33Monitor
• CVE-2015-0722The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a
  32Monitor
• CVE-2013-3378Cisco TelePresence TC Software before 6.1 and TE Software before 4.1.3 allow remote attackers to cause a denial of service (temporary device
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.