CVE-2011-0374

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-0374
The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote authenticated users to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31659.

9.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b6e152.shtml Vendor Advisory
http://www.securitytracker.com/id?1025112
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:cisco:telepresence_system_software:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:telepresence_system_1000:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:telepresence_system_1100:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:cisco:telepresence_system_software:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
cpe:2.3:h:cisco:telepresence_system_3000:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
cpe:2.3:h:cisco:telepresence_system_1300_series:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
cpe:2.3:h:cisco:telepresence_system_3200_series:*:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:a:cisco:telepresence_system_software:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.10:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.11:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.12:*:*:*:*:*:*:*
cpe:2.3:a:cisco:telepresence_system_software:1.5.13:*:*:*:*:*:*:*
cpe:2.3:h:cisco:telepresence_system_500_series:*:*:*:*:*:*:*:*
History

No history.

Information

Published : 2011-02-25 12:00

Updated : 2023-12-10 11:03

NVD link : CVE-2011-0374

Mitre link : CVE-2011-0374

CVE.ORG link : CVE-2011-0374

JSON object : View

Products Affected

cisco

  • telepresence_system_1300_series
  • telepresence_system_500_series
  • telepresence_system_1100
  • telepresence_system_software
  • telepresence_system_3200_series
  • telepresence_system_1000
  • telepresence_system_3000
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')