CVE-2019-1878
Cisco TelePresence Endpoint Command Shell Injection Vulnerability
- State
- Published
- Severity
- 7.5 High
- Published
- Jun 20, 2019
- Updated
- Nov 20, 2024
- Reserved
- Dec 6, 2018
Description
A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insufficient input validation of received CDP packets. An attacker could exploit this vulnerability by sending crafted CDP packets to an affected device. A successful exploit could allow the attacker to execute arbitrary shell commands or scripts on the targeted device.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.5 High | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | cisco |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Cisco TelePresence TC SoftwareCisco |
|
References
- 20190619 Cisco TelePresence Endpoint Command Shell Injection Vulnerabilityvendor-advisory
- 108883vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.