CVE-2023-20008

Published: Jan 20, 2023Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are in the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device.

Affected (60)

Products: Cisco: Roomos, Telepresence Collaboration Endpoint, Telepresence Tc

Cisco

3 products

Roomos

Telepresence Collaboration Endpoint

Telepresence Tc

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Cisco Roomos	Version 10.11.3.0
Cisco Roomos	Version 10.11.5.2
Cisco Roomos	Version 10.15.3.0
Cisco Roomos	Version 10.3.2.0
Cisco Roomos	Version 10.3.4.0
Cisco Roomos	Version 10.8.2.5
Cisco Roomos	Version 10.8.4.0

Configuration B

47 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence Collaboration Endpoint	Version 8.0.0
Cisco Telepresence Collaboration Endpoint	Version 8.0.1
Cisco Telepresence Collaboration Endpoint	Version 8.1.0
Cisco Telepresence Collaboration Endpoint	Version 8.1.1
Cisco Telepresence Collaboration Endpoint	Version 8.2.0
Cisco Telepresence Collaboration Endpoint	Version 8.2.1
Cisco Telepresence Collaboration Endpoint	Version 8.2.2
Cisco Telepresence Collaboration Endpoint	Version 8.3.0
Cisco Telepresence Collaboration Endpoint	Version 8.3.1
Cisco Telepresence Collaboration Endpoint	Version 8.3.2
Cisco Telepresence Collaboration Endpoint	Version 8.3.3
Cisco Telepresence Collaboration Endpoint	Version 8.3.5
Cisco Telepresence Collaboration Endpoint	Version 8.3.6
Cisco Telepresence Collaboration Endpoint	Version 9.0.1
Cisco Telepresence Collaboration Endpoint	Version 9.1.1
Cisco Telepresence Collaboration Endpoint	Version 9.1.2
Cisco Telepresence Collaboration Endpoint	Version 9.1.3
Cisco Telepresence Collaboration Endpoint	Version 9.1.4
Cisco Telepresence Collaboration Endpoint	Version 9.1.5
Cisco Telepresence Collaboration Endpoint	Version 9.1.6
Cisco Telepresence Collaboration Endpoint	Version 9.10.1
Cisco Telepresence Collaboration Endpoint	Version 9.10.2
Cisco Telepresence Collaboration Endpoint	Version 9.10.3
Cisco Telepresence Collaboration Endpoint	Version 9.12.3
Cisco Telepresence Collaboration Endpoint	Version 9.12.4
Cisco Telepresence Collaboration Endpoint	Version 9.12.5
Cisco Telepresence Collaboration Endpoint	Version 9.13.0
Cisco Telepresence Collaboration Endpoint	Version 9.13.1
Cisco Telepresence Collaboration Endpoint	Version 9.13.2
Cisco Telepresence Collaboration Endpoint	Version 9.13.3
Cisco Telepresence Collaboration Endpoint	Version 9.14.3
Cisco Telepresence Collaboration Endpoint	Version 9.14.4
Cisco Telepresence Collaboration Endpoint	Version 9.14.5
Cisco Telepresence Collaboration Endpoint	Version 9.14.6
Cisco Telepresence Collaboration Endpoint	Version 9.15.0.10
Cisco Telepresence Collaboration Endpoint	Version 9.15.0.11
Cisco Telepresence Collaboration Endpoint	Version 9.15.10.8
Cisco Telepresence Collaboration Endpoint	Version 9.15.13.0
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.25
Cisco Telepresence Collaboration Endpoint	Version 9.15.3.26
Cisco Telepresence Collaboration Endpoint	Version 9.15.8.12
Cisco Telepresence Collaboration Endpoint	Version 9.2.1
Cisco Telepresence Collaboration Endpoint	Version 9.2.2
Cisco Telepresence Collaboration Endpoint	Version 9.2.3
Cisco Telepresence Collaboration Endpoint	Version 9.2.4
Cisco Telepresence Collaboration Endpoint	Version 9.9.3
Cisco Telepresence Collaboration Endpoint	Version 9.9.4

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Cisco Telepresence Tc	Version 7.3.13
Cisco Telepresence Tc	Version 7.3.21
Cisco Telepresence Tc	Version 7.3.5
Cisco Telepresence Tc	Version 7.3.6
Cisco Telepresence Tc	Version 7.3.7
Cisco Telepresence Tc	Version 7.3.9

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (2)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK

Source: psirt@cisco.com

Vendor Advisory

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.