{"id":"CVE-2019-15962","state":"PUBLISHED","title":"Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability","description":"A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An attacker could exploit this vulnerability by logging in as the remotesupport user and writing files to the /root directory of an affected device.","publishedAt":"2019-10-16T18:36:47.177Z","updatedAt":"2024-11-21T19:06:25.578Z","severity":{"score":4.4,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco TelePresence TC Software"],"affected":[{"vendor":"Cisco","product":"Cisco TelePresence TC Software","versions":[{"version":"unspecified","status":"affected","lessThan":"n/a","versionType":"custom"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite"],"weaknesses":["CWE-275"],"ingestedAt":"2026-10-29T19:45:33.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/15xxx/CVE-2019-15962.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-15962","state":"PUBLISHED","datePublished":"2019-10-16T18:36:47.177Z","dateUpdated":"2024-11-21T19:06:25.578Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2019-09-06T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An attacker could exploit this vulnerability by logging in as the remotesupport user and writing files to the /root directory of an affected device."}],"affected":[{"vendor":"Cisco","product":"Cisco TelePresence TC Software","versions":[{"version":"unspecified","status":"affected","lessThan":"n/a","versionType":"custom"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite","name":"20191016 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-275","description":"CWE-275","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2019-10-16T18:36:47.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2019-10-16T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-20191016-tele-ce-filewrite","defect":[["CSCvq47315"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2019-10-16T16:00:00-0700","ID":"CVE-2019-15962","STATE":"PUBLIC","TITLE":"Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco TelePresence TC Software","version":{"version_data":[{"affected":"<","version_affected":"<","version_value":"n/a"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An attacker could exploit this vulnerability by logging in as the remotesupport user and writing files to the /root directory of an affected device."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"impact":{"cvss":{"baseScore":"4.4","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-275"}]}]},"references":{"reference_data":[{"name":"20191016 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite"}]},"source":{"advisory":"cisco-sa-20191016-tele-ce-filewrite","defect":[["CSCvq47315"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite","name":"20191016 Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T01:03:32.417Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-21T18:55:55.642275Z","id":"CVE-2019-15962","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-21T19:06:25.578Z"}}]}}}