What is CVE-2016-1387?

CVE-2016-1387 is a critical-severity vulnerability in Cisco Telepresence Tc Software, classified under Improper Authentication. CVSS score: 9.8/10. Published 2016-05-05.

How severe is CVE-2016-1387?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Cisco Telepresence Tc Software

CVE-2016-1387

The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles authentication, which allows remote attackers to execute control commands or make configuration changes via an API request, aka Bug ID CSCuz26935.

Vulnerability class: Broken Authentication

EPSS: 0.018 (75.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cisco Telepresence_tc_software — versions 7.2.0, 7.2.1, 7.3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)

Frequently asked questions

What is CVE-2016-1387?: CVE-2016-1387 is a critical-severity vulnerability in Cisco Telepresence Tc Software, classified under Improper Authentication. CVSS score: 9.8/10. Published 2016-05-05.
How severe is CVE-2016-1387?: Critical severity. CVSS v3 base score is 9.8 out of 10.