CVE-2018-15430: vulnerability in Cisco TelePresence Video Communication Server…
Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.9%
A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.
Affected products
Cisco · Cisco TelePresence Video Communication Server (VCS)Related CVEs — Cisco TelePresence Video Communication Server…
In the same product, most dangerous first.
CVE-2019-1845HIGHCisco Unified Communications Manager IM&P Service, Cisco TelePresence VCS, and Cisco Expressway Series Denial of Service VulnerabilityEPSS 4.6%CVE-2019-1721HIGHCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 2.0%CVE-2019-1720MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service VulnerabilityEPSS 1.7%CVE-2019-1872MEDIUMCisco TelePresence Video Communication Server and Cisco Expressway Series Server-Side Request Forgery VulnerabilityEPSS 1.5%CVE-2019-12705MEDIUMCisco Expressway Series and TelePresence Video Communication Server Cross-Site Scripting VulnerabilityEPSS 0.8%CVE-2019-1722MEDIUMCisco Expressway Series and Cisco TelePresence Video Communication Server Cross-Site Request Forgery VulnerabilityEPSS 0.7%