Unscored severity · published Aug 20, 2015
CVE-2015-4328
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to…
–
CVSS
2%
EPSS
No
On KEV
Description
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TV
Telepresence Video Communication Server Software · Cisco
x8.5.2 · source: NVD
Affected product
TV
Telepresence Video Communication Server Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4328
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=40522
Third Party Advisory
http://www.securityfocus.com/bid/76399
Third Party Advisory
http://www.securitytracker.com/id/1033329
More from Telepresence Video Communication Server Software
6.5
CVE-2016-1444
The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates,…
6.5
CVE-2016-1338
Cisco TelePresence Video Communication Server (VCS) X8.5.1 and X8.5.2 allows remote authenticated users to cause a denial of service (VoIP outage) via a crafted SIP message, aka…
5.3
CVE-2016-1316
Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7, as used in conjunction with Jabber Guest, allows remote attackers to obtain sensitive call-statistics…
–
CVE-2015-6410
The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to…
–
CVE-2015-6414
Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat…