Vulnerability Name:

CVE-2011-0375 (CCN-65614)

Assigned:2011-02-23
Published:2011-02-23
Updated:2011-03-31
Summary:The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.6.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCth24671.
CVSS v3 Severity:9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-78
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2011-0375

Source: CCN
Type: SA43488
Cisco ASA 5500 Series Multiple Vulnerabilities

Source: CCN
Type: cisco-sa-20110223-telepresence-cts
Multiple Vulnerabilities in Cisco TelePresence Endpoint Devices

Source: CISCO
Type: Vendor Advisory
20110223 Multiple Vulnerabilities in Cisco TelePresence Endpoint Devices

Source: CCN
Type: OSVDB ID: 72590
Cisco TelePresence CGI Implementation Authenticated Malformed Request Arbitrary Command Injection (2011-0375)

Source: CCN
Type: BID-46517
Cisco TelePresence Endpoint Devices Multiple Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1025112

Source: XF
Type: UNKNOWN
cisco-telepresence-command-execution(65614)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:telepresence_system_software:1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.8:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:telepresence_system_1000:*:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:telepresence_system_1100:*:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:cisco:telepresence_system_software:1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.8:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:telepresence_system_3000:*:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.8:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:telepresence_system_1300_series:*:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.8:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:telepresence_system_3200_series:*:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.7:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:telepresence_system_software:1.6.8:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:telepresence_system_500_series:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco telepresence system software 1.2.3
    cisco telepresence system software 1.3.2
    cisco telepresence system software 1.4.7
    cisco telepresence system software 1.5.1
    cisco telepresence system software 1.5.3
    cisco telepresence system software 1.5.10
    cisco telepresence system software 1.5.11
    cisco telepresence system software 1.5.12
    cisco telepresence system software 1.5.13
    cisco telepresence system software 1.6.0
    cisco telepresence system software 1.6.2
    cisco telepresence system software 1.6.3
    cisco telepresence system software 1.6.4
    cisco telepresence system software 1.6.5
    cisco telepresence system software 1.6.6
    cisco telepresence system software 1.6.7
    cisco telepresence system software 1.6.8
    cisco telepresence system 1000 *
    cisco telepresence system 1100 *
    cisco telepresence system software 1.2.3
    cisco telepresence system software 1.3.2
    cisco telepresence system software 1.4.7
    cisco telepresence system software 1.5.1
    cisco telepresence system software 1.5.3
    cisco telepresence system software 1.5.10
    cisco telepresence system software 1.5.11
    cisco telepresence system software 1.5.12
    cisco telepresence system software 1.5.13
    cisco telepresence system software 1.6.0
    cisco telepresence system software 1.6.2
    cisco telepresence system software 1.6.3
    cisco telepresence system software 1.6.4
    cisco telepresence system software 1.6.5
    cisco telepresence system software 1.6.6
    cisco telepresence system software 1.6.7
    cisco telepresence system software 1.6.8
    cisco telepresence system 3000 *
    cisco telepresence system software 1.5.10
    cisco telepresence system software 1.5.11
    cisco telepresence system software 1.5.12
    cisco telepresence system software 1.5.13
    cisco telepresence system software 1.6.0
    cisco telepresence system software 1.6.2
    cisco telepresence system software 1.6.3
    cisco telepresence system software 1.6.4
    cisco telepresence system software 1.6.5
    cisco telepresence system software 1.6.6
    cisco telepresence system software 1.6.7
    cisco telepresence system software 1.6.8
    cisco telepresence system 1300 series *
    cisco telepresence system software 1.4.7
    cisco telepresence system software 1.5.1
    cisco telepresence system software 1.5.3
    cisco telepresence system software 1.5.10
    cisco telepresence system software 1.5.11
    cisco telepresence system software 1.5.12
    cisco telepresence system software 1.5.13
    cisco telepresence system software 1.6.0
    cisco telepresence system software 1.6.2
    cisco telepresence system software 1.6.3
    cisco telepresence system software 1.6.4
    cisco telepresence system software 1.6.5
    cisco telepresence system software 1.6.6
    cisco telepresence system software 1.6.7
    cisco telepresence system software 1.6.8
    cisco telepresence system 3200 series *
    cisco telepresence system software 1.4.7
    cisco telepresence system software 1.5.1
    cisco telepresence system software 1.5.3
    cisco telepresence system software 1.5.10
    cisco telepresence system software 1.5.11
    cisco telepresence system software 1.5.12
    cisco telepresence system software 1.5.13
    cisco telepresence system software 1.6.0
    cisco telepresence system software 1.6.2
    cisco telepresence system software 1.6.3
    cisco telepresence system software 1.6.4
    cisco telepresence system software 1.6.5
    cisco telepresence system software 1.6.6
    cisco telepresence system software 1.6.7
    cisco telepresence system software 1.6.8
    cisco telepresence system 500 series *