CVE-2019-15289: high-severity vulnerability in Cisco TelePresence TC Software
Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.4%
Multiple vulnerabilities in the video service of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted traffic to the video service of an affected endpoint. A successful exploit could allow the attacker to cause the video service to crash, resulting in a DoS condition on an affected device.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Cisco · Cisco TelePresence TC SoftwareRelated CVEs — Cisco TelePresence TC Software
In the same product, most dangerous first.
CVE-2020-3143HIGHCisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal VulnerabilityEPSS 8.5%CVE-2019-15288HIGHCisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation VulnerabilityEPSS 1.7%CVE-2019-1878HIGHCisco TelePresence Endpoint Command Shell Injection VulnerabilityEPSS 1.1%CVE-2019-15274MEDIUMCisco TelePresence Collaboration Endpoint Software Command Injection VulnerabilityEPSS 0.5%CVE-2019-15275MEDIUMCisco TelePresence Collaboration Endpoint Software Privilege Escalation VulnerabilityEPSS 0.4%CVE-2019-15277MEDIUMCisco TelePresence Collaboration Endpoint Software Privilege Escalation VulnerabilityEPSS 0.4%