Not rated

CVE-2018-15430 A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video…

Description

A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.

Affected products and versions

Product	Affected versions	Fixed in
Cisco TelePresence Video Communication Server (VCS)	Versions not published

References

1041784 www.securitytracker.com
20181003 Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability tools.cisco.com

Timeline

Published October 5, 2018
Last modified November 26, 2024

The 7 CVEs of Cisco TelePresence Video Communication Server (VCS) →

CVE-2019-12705 A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video… 6.1 Medium CVE-2019-1872 A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could… 5.3 Medium CVE-2019-1845 A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM… 8.6 High CVE-2019-1720 A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS)… 6.8 Medium

Track this CVE