Cisco Show and Share File Upload Arbitrary Code Execution Vulnerability

Cisco Show and Share contains a vulnerability that could allow an authenticated, remote attacker to execute code on a vulnerable device.

The vulnerability is due to insecure restrictions when allowing videos to be uploaded to an affected device. An authenticated, remote attacker with privileges to upload videos could take advantage of this vulnerability to upload code to the device that would execute in the context of the web server.

Cisco has confirmed this vulnerability in a security advisory and has released updated software.

The attacker may need access to an internal, private network and would need valid login credentials to be able to upload files to the vulnerable device. These factors could limit the potential for a possible attempted exploit.

It should be noted that the uploaded code would execute in the context of the web server. This service runs with non-root privileges. This factor could limit the severity of the impact of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.