// For flags

CVE-2018-15430

Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability

Severity Score

7.2
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.

Una vulnerabilidad en la interfaz web administrativa de Cisco Expressway Series y Cisco TelePresence Video Communication Server (VCS) podría permitir que un atacante remoto autenticado ejecute código con privilegios de nivel de usuario en el sistema operativo subyacente. Esta vulnerabilidad se debe a una validación insuficiente del contenido de los paquetes de actualización. Un atacante podría explotar esta vulnerabilidad subiendo un archivo malicioso a la página Upgrade de la interfaz web administrativa. Su explotación con éxito podría permitir que el atacante ejecute código con privilegios de nivel de usuario en el sistema operativo subyacente.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-08-17 CVE Reserved
  • 2018-10-05 CVE Published
  • 2024-08-12 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Telepresence Video Communication Server
Search vendor "Cisco" for product "Telepresence Video Communication Server"
 x7.2.4
Search vendor "Cisco" for product "Telepresence Video Communication Server" and version "x7.2.4"
-
Affected
Cisco
Search vendor "Cisco"
 Telepresence Video Communication Server
Search vendor "Cisco" for product "Telepresence Video Communication Server"
 x8.9.2
Search vendor "Cisco" for product "Telepresence Video Communication Server" and version "x8.9.2"
-
Affected
Cisco
Search vendor "Cisco"
 Telepresence Video Communication Server
Search vendor "Cisco" for product "Telepresence Video Communication Server"
 x8.10.4
Search vendor "Cisco" for product "Telepresence Video Communication Server" and version "x8.10.4"
-
Affected