Lucene search

K
ciscoCiscoCISCO-SA-20171115-VOS
HistoryNov 15, 2017 - 4:00 p.m.

Cisco Voice Operating System-Based Products Unauthorized Access Vulnerability

2017-11-1516:00:00
tools.cisco.com
38

0.038 Low

EPSS

Percentile

91.9%

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device.

The vulnerability occurs when a refresh upgrade or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access to the device with a known password.

If the vulnerable device is subsequently upgraded using the standard upgrade method to an Engineering Special Release, service update, or a new major release of the affected product, this vulnerability is remediated by that action.

Note: Engineering Special Releases that are installed as COP files, as opposed to the standard upgrade method, do not remediate this vulnerability.

An attacker who can access an affected device over SFTP while it is in a vulnerable state could gain root access to the device. This access could allow the attacker to compromise the affected system completely.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-vos [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-vos”]

Affected configurations

Vulners
Node
ciscoemergency_responderMatchany
OR
ciscounity_connectionMatchany
OR
ciscounified_communications_managerMatchany
OR
ciscounified_contact_center_expressMatchany
OR
ciscohosted_collaboration_solutionMatchany
OR
ciscounified_communications_manager_im_and_presence_serviceMatchany
OR
ciscofinesseMatchany
OR
ciscosocialminerMatchany
OR
ciscomediasenseMatchany
OR
ciscounified_intelligence_centerMatchany
OR
ciscoprime_license_managerMatchany
OR
ciscoemergency_responderMatchany
OR
ciscounity_connectionMatchany
OR
ciscounified_communications_managerMatchany
OR
ciscounified_contact_center_expressMatchany
OR
ciscohosted_collaboration_solutionMatchany
OR
ciscounified_communications_manager_im_and_presence_serviceMatchany
OR
ciscofinesseMatchany
OR
ciscosocialminerMatchany
OR
ciscomediasenseMatchany
OR
ciscounified_intelligence_centerMatchany
OR
ciscoprime_license_managerMatchany

0.038 Low

EPSS

Percentile

91.9%

Related for CISCO-SA-20171115-VOS