جزئیات آسیبپذیری
CVE-2022-20814
Cisco TelePresence Video Communication Server ExpresswayCisco telepresence_video_communication_server
Cisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation Vulnerability
CVSS 3.1
7.4بالا
شرح رسمی (انگلیسی)
A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic. Note: Cisco Expressway-E is not affected by this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.4بالا | 3.1 | CVEProject cvelistV5 (CNA) (cisco) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.7 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.8 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.5.9 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.6.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.6.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.6.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.6.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.6.4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.7.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X12.7.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.7 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.8 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X14.0.9 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.1.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.1.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.10.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.10.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.10.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.10.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.10.4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.11.0 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.11.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.11.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.11.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.11.4 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.2.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.2.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.5 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.5.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.5.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.5.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.6 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.6.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.7 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.7.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.7.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.7.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.8 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.8.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.8.2 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.8.3 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.9 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.9.1 | CVEProject cvelistV5 (CNA) |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.9.2 | CVEProject cvelistV5 (CNA) |
| Cisco | telepresence_video_communication_server | v < 14.2 | CISA ADP / Vulnrichment |
منابع و راهنماها
۴- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۳/۰۸/۲۵
- آخرین بهروزرسانی
- ۱۴۰۳/۰۸/۲۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- cisco
پیشبینی بهرهبرداری (EPSS)
۰٫۹۱٪
احتمال بهرهبرداری در ۳۰ روز
۶۰٫۱٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-295Improper Certificate Validation