RCE in Cisco Show And Share

CVE-2011-2585

Cisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote authenticated users to upload and execute arbitrary code by leveraging video upload privileges, aka Bug ID CSCto69857.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (80.1th percentile) — read the EPSS interpretation.

Affected products

Cisco Show_and_share — versions 5\(2\), 5.2\(1\)
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@cisco.com (vdb-entry, x_refsource_BID)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)