Vulnerability identifier: #VU24664

Vulnerability risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-3143

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco TelePresence Collaboration Endpoint (CE)
Hardware solutions / Office equipment, IP-phones, print servers
Cisco TelePresence Codec (TC)
Server applications / Conferencing, Collaboration and VoIP solutions
Cisco RoomOS
Operating systems & Components / Operating system

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the video endpoint API. A remote authenticated attacker can send a specially crafted HTTP request and read and write arbitrary files on the system.

This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco TelePresence CE Software, Cisco TC Software, or Cisco RoomOS Software:

• Cisco TelePresence Integrator C Series
• Cisco TelePresence MX Series
• Cisco TelePresence SX Series
• Cisco TelePresence System EX Series
• Cisco Webex Board
• Cisco Webex DX Series
• Cisco Webex Room Series

Mitigation
Install update from vendor's website.

Vulnerable software versions

Cisco TelePresence Collaboration Endpoint (CE): 8.3.5 - 9.4.0

Cisco TelePresence Codec (TC): 7.0.1 - 7.3.19

Cisco RoomOS: All versions

---

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-telepresence-path-tr-wdrnYEZZ

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.