Medium severity · published Oct 16, 2019
CVE-2019-15273
Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Cisco TelePresence TC Software · Cisco
before n/a · source: vendor
TC
Telepresence Collaboration Endpoint · Cisco
before 9.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15273
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-file-ovrwrt
More from Cisco TelePresence TC Software
8.8
CVE-2019-15288
Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
8.8
CVE-2019-1878
Cisco TelePresence Endpoint Command Shell Injection Vulnerability
7.5
CVE-2019-15289
Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerabilities
7.2
CVE-2020-3143
Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal Vulnerability
6.7
CVE-2019-15277
Cisco TelePresence Collaboration Endpoint Software Privilege Escalation Vulnerability
