CVE-2011-4659

Cisco TelePresence Software before TE 4.1.1 on the Cisco IP Video Phone E20 has a default password for the root account after an upgrade to TE 4.1.0, which makes it easier for remote attackers to modify the configuration via an SSH session, aka Bug ID CSCtw69889, a different vulnerability than CVE-2011-2555.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120118-te	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:cisco:telepresence_e20_software::::::::
	cpe:2.3:a:cisco:telepresence_e20_software:te2.2:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:te2.2.1:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:te4.0.0:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:te4.1.0:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:te4.1.1:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:tenc4.0.0:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:tenc4.1.0:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:tenc4.1.1:::::::*
	cpe:2.3:a:cisco:telepresence_e20_software:tenc4.1.1-cucm:::::::*

cpe:2.3:h:cisco:ip_video_phone_e20:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2012-01-19 15:55

Updated : 2012-02-10 05:00

NVD link : CVE-2011-4659

Mitre link : CVE-2011-4659

CVE.ORG link : CVE-2011-4659

JSON object : View

Products Affected

cisco

ip_video_phone_e20
telepresence_e20_software

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-4659", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-01-19T15:55:00.820", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120118-te", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Cisco TelePresence Software before TE 4.1.1 on the Cisco IP Video Phone E20 has a default password for the root account after an upgrade to TE 4.1.0, which makes it easier for remote attackers to modify the configuration via an SSH session, aka Bug ID CSCtw69889, a different vulnerability than CVE-2011-2555."}, {"lang": "es", "value": "Cisco TelePresence Software antes de TE v4.1.1 en el Cisco IP Video Phone E20 tiene una contrase\u00f1a por defecto para la cuenta de root tras una actualizaci\u00f3n a la v4.1.0 TE, lo cual permite modificar la configuraci\u00f3n a trav\u00e9s de una sesi\u00f3n SSH a atacantes remotos. Se trata de un problema tambi\u00e9n conocido como Bug ID CSCtw69889 y es diferente al CVE-2011-2555."}], "lastModified": "2012-02-10T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F283D9C2-6417-4164-ABCF-92CDCEE0369F", "versionEndIncluding": "te4.1.1-cucm"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:te2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F1FA842-B89F-4297-8C32-E07E8DD64A3D"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:te2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F1890CD-A9DE-426A-9769-BD69D38C38AA"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:te4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71BC3E49-C15E-4658-BC03-F0AC5913B4BC"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:te4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A0F3990-2C2F-4CF7-9F8B-2F799A89FA2F"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:te4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2AC50D6-6989-4E1D-A5EF-BA8BCC90F8EB"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:tenc4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D31C6E3-3D59-4980-B1C9-1F8F625CF1D0"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:tenc4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B75F0545-9A8D-4199-9BD0-CC4FA590DD8A"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:tenc4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6D61CB9-78CE-4FB7-BBC8-F94E4D59BB3C"}, {"criteria": "cpe:2.3:a:cisco:telepresence_e20_software:tenc4.1.1-cucm:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75788217-A69B-4F08-B16C-A2A8BE9FD32A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ip_video_phone_e20:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBFD8721-837D-4FD8-A84F-D844E5C199D5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}