CVE Vulnerability

CVE-2019-1878

A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insufficient input validation of received CDP packets. An attacker could exploit this vulnerability by sending crafted CDP packets to an affected device. A successful exploit could allow the attacker to execute arbitrary shell commands or scripts on the targeted device.

8.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.5 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-tele-shell-inj Vendor Advisory
http://www.securityfocus.com/bid/108883 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:cisco:telepresence_tc:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_ce:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_ce:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_ce:*:*:*:*:*:*:*:*
Information

Published : 2019-06-20 03:15

Updated : 2019-10-09 11:48

NVD link : CVE-2019-1878

Mitre link : CVE-2019-1878

Products Affected
No products.
CWE
CWE-78