Permissions, Privileges, and Access Controls in Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS - CVE-2023-20090
Published: April 20, 2023
Vulnerability identifier: #VU75376
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-20090
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco TelePresence Collaboration Endpoint (CE)
Cisco RoomOS
Cisco TelePresence Collaboration Endpoint (CE)
Cisco RoomOS
Detailed vulnerability description
The vulnerability allows a local administrator to escalate privileges on the system.
The vulnerability exists due to improper access control on certain CLI commands, which leads to security restrictions bypass and privilege escalation.
How to mitigate CVE-2023-20090
Install updates from vendor's website.