Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.9%
exploitation probability
2.9%top 14% of all CVEs
observed exploitation
nono source reports it
A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.
Affected products
Cisco · Cisco TelePresence Video Communication Server (VCS)