CVE-2021-1532: medium-severity vulnerability in Cisco TelePresence Endpoint Software (TC/CE)
Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Read Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 1.4%
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation of command arguments. An attacker could exploit this vulnerability by sending a crafted command request to the xAPI. A successful exploit could allow the attacker to read the contents of any file that is located on the device filesystem.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco TelePresence Endpoint Software (TC/CE)Related CVEs — Cisco TelePresence Endpoint Software (TC/CE)
In the same product, most dangerous first.
CVE-2020-26086MEDIUMCisco TelePresence Collaboration Endpoint Software Information Disclosure VulnerabilityEPSS 0.8%CVE-2020-26068MEDIUMCisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation VulnerabilityEPSS 0.7%CVE-2022-20793MEDIUMCisco Touch 10 Device Insufficient Identity Verification VulnerabilityEPSS 0.4%CVE-2026-20119HIGHCisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service VulnerabilityEPSS 0.4%CVE-2022-20931MEDIUMCisco Touch 10 Device Downgrade Attack VulnerabilityEPSS 0.3%CVE-2023-20094MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure VulnerabilityEPSS 0.3%