Vulnslist

Cisco vulnerabilities by product, model, software, and advisory.

Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability

cisco-sa-ewrce-QPynNCjh · Medium · Published · Updated

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then uploading specific crafted software images to the affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewrce-QPynNCjh

Cisco advisory · CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

While the following mitigations have been deployed and were proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Firewall Rule Modifications
Access to the management plane of Cisco Expressway Series and Cisco TelePresence VCS should be restricted to trusted networks. Administrators can restrict access to the management ports (HTTPS/SSH) within the firewall rules on the device or by using an external firewall. The web UI port numbers can also be modified in the configuration.

As a best practice, access to the management plane of Cisco Expressway Series and Cisco TelePresence VCS should not be exposed to the internet. For additional information, see the Intrusion Protection ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/admin_guide/X14-0/exwy_b_cisco-expressway-administrator-guide/exwy_m_network-and-system-settings.html#reference_749C6B6E7566A37934C9AD39ED91E612"] section of the Cisco Expressway Administrator Guide ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/admin_guide/X14-0/exwy_b_cisco-expressway-administrator-guide/exwy_m_managing-security.html"].
Dedicated Management Interface
As a best practice, access to the management plane of Cisco Expressway Series and Cisco TelePresence VCS should not be exposed to the internet. Beginning with Release X12.7, the product introduced a Dedicated Management Interface (DMI). Administrators can enable the DMI and implement the following configuration:

Allow the DMI to be the only interface used for management
Configure the DMI to be accessed only from trusted segments

For additional information, see Configuring the Dedicated Management Interface (DMI) ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/admin_guide/X14-0/exwy_b_cisco-expressway-administrator-guide/exwy_m_network-and-system-settings.html#reference_5EB4447A6E9556705392D8970EC2EA50"] section of the Cisco Expressway Administrator Guide ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/admin_guide/X14-0/exwy_b_cisco-expressway-administrator-guide/exwy_m_managing-security.html"].
Client Certificate-Based Security
This vulnerability can be exploited only by an authenticated administrator. Using client authentication certificates helps prevent brute forcing of the administrative passwords. For additional information, see the Configuring Certificate-Based Authentication ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/admin_guide/X14-0/exwy_b_cisco-expressway-administrator-guide/exwy_m_managing-security.html#reference_BCD936F444AADC9C4311E0B1820A89AD"] section of the Cisco Expressway Administrator Guide ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/admin_guide/X14-0/exwy_b_cisco-expressway-administrator-guide/exwy_m_managing-security.html"].

CVEsCVE-2021-34716
Cisco Bug IDsCSCvy96491
CVSS ScoreBase 6.7
Base 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:X/RL:X/RC:X
Product Names From Source
Cisco TelePresence Video Communication Server (VCS) Expressway

Related Products

Product CVE Evidence
Cisco TelePresence Video Communication Server (VCS) Expressway CVE-2021-34716 Cisco OpenVuln
Cisco TelePresence Video Communication Server (VCS) CVE-2021-34716 Cisco OpenVuln
Cisco TelePresence CVE-2021-34716 Cisco OpenVuln
Cisco Expressway CVE-2021-34716 Cisco OpenVuln