CVE-2011-0378

Published: Feb 25, 2011Modified: Apr 29, 2026

8.3

Vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 6.5 / Impact: 10.0

Source: NVD

Description

The XML-RPC implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a TCP request, related to a "command injection vulnerability," aka Bug ID CSCtb52587.

Affected (15)

Products: Cisco: Telepresence System 1000, Telepresence System 1100, Telepresence System Software, Telepresence System 3000, Telepresence System 1300 Series, Telepresence System 3200 Series, Telepresence System 500 Series

Cisco

7 products

Telepresence System 1000

Telepresence System 1100

Telepresence System Software

Telepresence System 3000

Telepresence System 1300 Series

Telepresence System 3200 Series

Telepresence System 500 Series

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence System 1000	All versions
Cisco Telepresence System 1100	All versions

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence System Software	Version 1.2.3
Cisco Telepresence System Software	Version 1.3.2
Cisco Telepresence System 3000	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence System 1300 Series	All versions

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence System 3200 Series	All versions

Configuration E

8 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence System Software	Version 1.4.7
Cisco Telepresence System Software	Version 1.5.10
Cisco Telepresence System Software	Version 1.5.11
Cisco Telepresence System Software	Version 1.5.12
Cisco Telepresence System Software	Version 1.5.13
Cisco Telepresence System Software	Version 1.5.1
Cisco Telepresence System Software	Version 1.5.3
Cisco Telepresence System 500 Series	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml

Source: psirt@cisco.com

Vendor Advisory

http://www.securitytracker.com/id?1025112

Source: psirt@cisco.com

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securitytracker.com/id?1025112

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.