CVE-2016-1387 The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles auth...
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles authentication, which allows remote attackers to execute control commands or make configuration changes via an API request, aka Bug ID CSCuz26935.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco telepresence tc software | = 7.2.0 | No fix listed |
| cisco telepresence tc software | = 7.2.1 | No fix listed |
| cisco telepresence tc software | = 7.3.0 | No fix listed |
| cisco telepresence tc software | = 7.3.1 | No fix listed |
| cisco telepresence tc software | = 7.3.2 | No fix listed |
| cisco telepresence tc software | = 7.3.3 | No fix listed |
References
- 20160504 Cisco TelePresence XML Application Programming Interface Authentication Bypass Vulnerability vendor-advisory
- 1035744 vdb-entry