VulnerabilityModified

CVE-2020-3143

HIGH 7.2EPSS 8.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the xAPI of the affected software. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the system. To exploit this vulnerability, an attacker would need either an In-Room Control or administrator account.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 8.45% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: cisco/ex60 firmware · cisco/ex90 firmware · cisco/sx10 firmware · cisco/sx20 firmware · cisco/sx80 firmware · cisco/telepresence codec c40 firmware · cisco/telepresence codec c60 firmware · cisco/telepresence codec c90 firmware · cisco/telepresence mx200 firmware · cisco/telepresence mx300 firmware · cisco/telepresence mx700 firmware · cisco/telepresence mx800 firmware · cisco/webex board 55 firmware · cisco/webex board 55s firmware · cisco/webex board 70 firmware · cisco/webex board 70s firmware · cisco/webex board 85s firmware · cisco/webex dx70 firmware · cisco/webex dx80 firmware · cisco/webex room 55 firmware · +1 more
Source: psirt@cisco.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.