Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-3143

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the xAPI of the affected software. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the system. To exploit this vulnerability, an attacker would need either an In-Room Control or administrator account.

Published

2020-09-23T01:15:15.410

Last Modified

2024-11-21T05:30:24.860

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.2 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-22
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco ex60_firmware - Yes
Hardware cisco ex60 - No
Operating System cisco ex90_firmware - Yes
Hardware cisco ex90 - No
Operating System cisco sx10_firmware - Yes
Hardware cisco sx10 - No
Operating System cisco sx20_firmware - Yes
Hardware cisco sx20 - No
Operating System cisco sx80_firmware - Yes
Hardware cisco sx80 - No
Operating System cisco telepresence_codec_c40_firmware - Yes
Hardware cisco telepresence_codec_c40 - No
Operating System cisco telepresence_codec_c60_firmware - Yes
Hardware cisco telepresence_codec_c60 - No
Operating System cisco telepresence_codec_c90_firmware - Yes
Hardware cisco telepresence_codec_c90 - No
Operating System cisco telepresence_mx200_firmware - Yes
Hardware cisco telepresence_mx200 - No
Operating System cisco telepresence_mx300_firmware - Yes
Hardware cisco telepresence_mx300 - No
Operating System cisco telepresence_mx700_firmware - Yes
Hardware cisco telepresence_mx700 - No
Operating System cisco telepresence_mx800_firmware - Yes
Hardware cisco telepresence_mx800 - No
Operating System cisco webex_board_55_firmware - Yes
Hardware cisco webex_board_55 - No
Operating System cisco webex_board_55s_firmware - Yes
Hardware cisco webex_board_55s - No
Operating System cisco webex_board_70_firmware - Yes
Hardware cisco webex_board_70 - No
Operating System cisco webex_board_70s_firmware - Yes
Hardware cisco webex_board_70s - No
Operating System cisco webex_board_85s_firmware - Yes
Hardware cisco webex_board_85s - No
Operating System cisco webex_dx70_firmware - Yes
Hardware cisco webex_dx70 - No
Operating System cisco webex_dx80_firmware - Yes
Hardware cisco webex_dx80 - No
Operating System cisco webex_room_55_firmware - Yes
Hardware cisco webex_room_55 - No
Operating System cisco webex_room_70_firmware - Yes
Hardware cisco webex_room_70 - No
References