Information disclosure in Cisco Telepresence System Software Ix

CVE-2015-6276

Cisco TelePresence IX5000 8.0.3 stores a private key associated with an X.509 certificate under the web root with insufficient access control, which allows remote attackers to obtain cleartext versions of HTTPS traffic or spoof devices via a direct request to the certificate directory, aka Bug ID CSCuu63501.

Vulnerability class: Information Disclosure

EPSS: 0.012 (65.1th percentile) — read the EPSS interpretation.

Affected products

Cisco Telepresence_system_software_ix — versions 8.0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)