CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Input Validation
Summary: a vulnerability in the administrative web interface of cisco expressway series and cisco telepresence video communication server (vcs) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. the vulnerability is due to insufficient validation of the content of upgrade packages. an attacker could exploit this vulnerability by uploading a malicious archive to the upgrade page of the administrative web interface. a successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-10-05
Last Modified Date: 2019-10-09