VDB
CVE-2021-1532
CVE-2021-1532
PUBLISHED
CVSS 6.5 MEDIUM
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation of command arguments. An attacker could exploit this vulnerability by sending a crafted command request to the xAPI. A successful exploit could allow the attacker to read the contents of any file that is located on the device filesystem.
EPSS 1.43% · 72.2th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
1.43%
72.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco TelePresence Endpoint Software (TC/CE) | n/a |
| cisco | telepresence_collaboration_endpoint | 0, 9.15.0.11 |
| cisco | roomos | 0 |
Timeline
- May 6, 2021 CVE Published
- May 7, 2021 EPSS Score
- Jul 10, 2021 EPSS Score
- Sep 11, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 14, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 17, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 19, 2022 EPSS Score
- Sep 22, 2022 EPSS Score
- Nov 23, 2022 EPSS Score