Vulnerability in Cisco Telepresence Management Suite (Tms)
CVE-2019-1660
A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this vulnerability by gaining access to internal, trusted networks to send crafted SOAP calls to the affected device. If successful, an exploit could allow the attacker to access system management tools. Under normal circumstances, this access should be prohibited.
EPSS: 0.022 (80.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Cisco Telepresence Management Suite (Tms) — versions n/a
- Cisco Telepresence_management_suite — versions 15.0, 15.1, 15.2.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-1660?
- CVE-2019-1660 is a medium-severity vulnerability in Cisco Telepresence Management Suite (Tms), classified under Improper Access Control. CVSS score: 5.3/10. Published 2019-02-07.
- How severe is CVE-2019-1660?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2019-1660 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.