Vulnerability Details : CVE-2011-0374
The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659.
Products affected by CVE-2011-0374
- cpe:2.3:a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_1000:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_1100:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_3000:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_1300_series:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_3200_series:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_500_series:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-0374
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 43 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-0374
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST |
CWE ids for CVE-2011-0374
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-0374
-
http://www.securitytracker.com/id?1025112
Cisco TelePresence Endpoint Devices Have Flaws That Let Remote Users Deny Service and Execute Arbitrary Commands and Code - SecurityTracker
-
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml
Multiple Vulnerabilities in Cisco TelePresence Endpoint Devices - CiscoVendor Advisory
Jump to