Information disclosure in Cisco TelePresence Management Suite - CVE-2019-1660
Published: February 7, 2019
Vulnerability identifier: #VU17432
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1660
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists in the Simple Object Access Protocol (SOAP) due to a lack of proper access and authentication controls on the affected TMS software. A remote attacker can gain access to internal, trusted networks to send crafted SOAP calls to the affected device and access system management tools.
Affected software
Cisco TelePresence Management Suite
How to mitigate CVE-2019-1660
No release planned to fix this bug.