CVE-2023-20090

Summary

A vulnerability in Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to elevate privileges to root on an affected device.

This vulnerability is due to improper access control on certain CLI commands. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to elevate privileges to root. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco RoomOS SoftwareN/Aaffected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.10.2affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.1.4affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.9.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.10.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.1.5affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.2.4affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.10.1affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.13.0affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.1.2affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.1.1affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.9.4affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.2.1affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.1.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.0.1affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.1.6affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.12.4affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.2.2affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.12.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.2.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.13.1affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.14.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.14.4affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.13.2affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.12.5affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.14.5affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.0.10affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.0.11affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.13.3affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.0.13affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.14.6affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.3.17affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.14.7affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.0.19affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.3.19affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.3.18affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.3.22affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.8.12affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.10.8affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.3.26affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.3.25affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.13.0affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.15.4affected
CiscoCisco TelePresence Endpoint Software (TC/CE)CE9.15.16.5affected

Weaknesses

  • CWE-27: Path Traversal: 'dir/../../filename'

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References