Description
A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack through an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a user of the web application. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Cisco Cisco RoomOS Software
RoomOS 10.3.2.0affectedRoomOS 10.3.4.0affectedRoomOS 10.8.2.5affectedRoomOS 10.11.5.2affectedRoomOS 10.8.4.0affectedRoomOS 10.11.3.0affectedRoomOS 10.15.3.0affected
Cisco Cisco TelePresence Endpoint Software (TC/CE)
CE9.0.1affectedCE9.1.1affectedCE9.1.2affectedCE9.1.3affectedCE9.1.4affectedCE9.1.5affectedCE9.1.6affectedCE9.10.1affectedCE9.10.2affectedCE9.10.3affectedCE9.12.4affectedCE9.12.5affectedCE9.12.3affectedCE9.13.0affectedCE9.13.1affectedCE9.13.3affectedCE9.13.2affectedCE9.2.1affectedCE9.2.2affectedCE9.2.3affectedCE9.2.4affectedCE9.9.3affectedCE9.9.4affectedCE9.14.3affectedCE9.14.5affectedCE9.14.4affectedCE9.14.6affectedCE9.14.7affectedCE9.15.0.11affectedCE9.15.0.10affectedCE9.15.10.8affectedCE9.15.3.26affectedCE9.15.3.25affectedCE9.15.3.17affectedCE9.15.3.22affectedCE9.15.0.19affectedRoomOS 10.8.4.0affectedRoomOS 10.11.3.0affectedRoomOS 10.11.5.2affectedRoomOS 10.15.3.0affected9.15.3.25affected