CVE-2019-15273: Cisco TelePresence Collaboration Endpoint Software Arbitrary File Overwrite Vulnerabilities

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-16 · updated 2026-06-17
Weakness: CWE-20

Description

Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitrary files. The vulnerabilities are due to insufficient permission enforcement. An attacker could exploit these vulnerabilities by authenticating as the remote support user and submitting malicious input to specific commands. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying filesystem. The attacker has no control over the contents of the data written to the file. Overwriting a critical file could cause the device to crash, resulting in a denial of service condition (DoS).

Affected products

Cisco TelePresence Endpoint Software (TC/CE): before 9.8.1 — fixed in 9.8.1

How to fix

Upgrade to a fixed version: Cisco TelePresence Endpoint Software (TC/CE) 9.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-15273 or the next vulnerability affects your stack