CVE-2018-15430CWE-20

Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability

published October 5, 2018

CVSS
—
EPSS
3%
Percentile
86.6
In the wild
Unconfirmed
What it is

A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02874 · 86.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-10-05T14:00Z
EPSS history
Timeline
  • 05 OCT 14:00Z
    Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability
    cvelistv5