CVE-2023-20192 - Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities

Back Back to CVE browser

CRITICAL

Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities

Published Jun 28, 2023

9.6

CRITICAL

CVSS 3.1

EPSS 0.66%

Description

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products

Vendor Cisco Product Cisco TelePresence Video Communication Server (VCS) Expressway Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco TelePresence Video Communication Server (VCS) Expressway

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24371
Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24371		Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b		vendor-advisoryVendor Advisory