CVE-2012-3075

Published: Jul 12, 2012Modified: Apr 29, 2026

9.0

Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 8.0 / Impact: 10.0

Source: NVD

Description

The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.

Affected (33)

Products: Cisco: Telepresence System Software, Telepresence System 1300 65, Telepresence System 3000, Telepresence System 3010, Telepresence System 3200, Telepresence System 3210, Telepresence System T3, Telepresence System Tx1300 47, Telepresence System Tx1310 65, Telepresence System Tx9000, Telepresence System Tx9200

Cisco

11 products

Telepresence System Software

Telepresence System 1300 65

Telepresence System 3000

Telepresence System 3010

Telepresence System 3200

Telepresence System 3210

Telepresence System T3

Telepresence System Tx1300 47

Telepresence System Tx1310 65

Telepresence System Tx9000

Telepresence System Tx9200

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence System Software	Up to 1.7.2\(4937\)
Cisco Telepresence System Software	Version 1.2.3(1101)
Cisco Telepresence System Software	Version 1.3.2(1393)
Cisco Telepresence System Software	Version 1.4.7(2229)
Cisco Telepresence System Software	Version 1.5.10(3648)
Cisco Telepresence System Software	Version 1.5.11(3659)
Cisco Telepresence System Software	Version 1.5.12(3701)
Cisco Telepresence System Software	Version 1.5.13(3717)
Cisco Telepresence System Software	Version 1.5.1(2082)
Cisco Telepresence System Software	Version 1.5.3(2115)
Cisco Telepresence System Software	Version 1.6.0(3954)
Cisco Telepresence System Software	Version 1.6.2(4023)
Cisco Telepresence System Software	Version 1.6.3(4042)
Cisco Telepresence System Software	Version 1.6.4(4072)
Cisco Telepresence System Software	Version 1.6.5(4097)
Cisco Telepresence System Software	Version 1.6.6(4109)
Cisco Telepresence System Software	Version 1.6.7(4212)
Cisco Telepresence System Software	Version 1.6.8(4222)
Cisco Telepresence System Software	Version 1.7.0.1(4764)
Cisco Telepresence System Software	Version 1.7.0.2(4719)
Cisco Telepresence System Software	Version 1.7.1(4864)
Cisco Telepresence System Software	Version 1.7.2.1(2)
Cisco Telepresence System 1300 65	All versions
Cisco Telepresence System 3000	All versions
Cisco Telepresence System 3010	All versions
Cisco Telepresence System 3200	All versions
Cisco Telepresence System 3210	All versions
Cisco Telepresence System T3	All versions
Cisco Telepresence System T3	All versions
Cisco Telepresence System Tx1300 47	All versions
Cisco Telepresence System Tx1310 65	All versions
Cisco Telepresence System Tx9000	All versions
Cisco Telepresence System Tx9200	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.