Improper input validation in Cisco Telepresence Tc Software

CVE-2014-2169

Cisco TelePresence TC Software 4.x through 6.x before 6.2.0 and TE Software 4.x and 6.0 allow remote authenticated users to execute arbitrary commands by using the commands as arguments to internal system scripts, aka Bug ID CSCue60211.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.021 (79.7th percentile) — read the EPSS interpretation.

Affected products

Cisco Telepresence_tc_software — versions 4.0.0, 4.0.1, 4.0.4
Cisco Telepresence_te_software — versions 4.1.0, 4.1.1, 4.1.2
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)