Vulnerability Details : CVE-2014-0661
The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2014-0661
- cpe:2.3:a:cisco:telepresence_system_software:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.8.2\(11\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.8.0\(55\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.8.3\(4\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.0\(46\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.7.5\(42\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.5.10\(3648\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.8.1\(34\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.7.6\(4\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.6\(2\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.5\(7\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:6.0.2\(28\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.4\(19\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.2\(19\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:6.0.0.1\(4\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.3\(44\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.1\(68\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:6.0.1\(50\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.10.0\(259\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.9.6.1\(3\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.8.5\(4\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:1.8.4\(13\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:telepresence_system_software:6.1.0\(90\):*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_1000:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_1100:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_3000:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_3210:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_3200:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_3010:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_tx9200:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_tx9000:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_tx1310_65:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_tx1300_47:*:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_1300-65:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_500-32:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:telepresence_system_500-37:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-0661
1.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-0661
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.3
|
HIGH | AV:A/AC:L/Au:N/C:C/I:C/A:C |
6.5
|
10.0
|
NIST |
CWE ids for CVE-2014-0661
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0661
-
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-cts
Cisco TelePresence System Software Command Execution VulnerabilityVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/90624
Cisco TelePresence System Status Collection Daemon command execution CVE-2014-0661 Vulnerability Report
-
http://www.securityfocus.com/bid/65071
Cisco TelePresence System Arbitrary Command Execution VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1029656
Cisco TelePresence System Software Input Validation Flaw in SSCD Lets Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
Jump to