RCE in Cisco Telepresence Manager
CVE-2012-2486
The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoint Devices before 1.9.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence Recording Server before 1.8.1 allows remote attackers to execute arbitrary code by leveraging certain adjacency and sending a malformed CDP packet, aka Bug IDs CSCtz40953, CSCtz40947, CSCtz40965, and CSCtz40953.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.017 (76.3th percentile) — read the EPSS interpretation.
Affected products
- Cisco Telepresence_manager — versions 1.6.5\(167\), 1.6.2(64), 1.3.2\(466\)
- Cisco Telepresence_multipoint_switch
- Cisco Telepresence_multipoint_switch_software — versions 1.5.5(1), 1.6.1, 1.6.2\(3\)
- Cisco Telepresence_recording_server — versions 1.7.0(190), 1.7.2.1, 1.7.1\(22\)
- Cisco Telepresence_system_1300_65
- Cisco Telepresence_system_3000
- Cisco Telepresence_system_3010
- Cisco Telepresence_system_3200
- Cisco Telepresence_system_3210
- Cisco Telepresence_system_software — versions 1.7.6\(4\), 1.7.4\(270\), 1.5.11\(3659\)
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)