CVE-2019-15962: Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-16 · updated 2026-06-17
Weakness: CWE-275

Description

A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root directory of an affected device. The vulnerability is due to improper permission assignment. An attacker could exploit this vulnerability by logging in as the remotesupport user and writing files to the /root directory of an affected device.

Affected products

Cisco TelePresence Endpoint Software (TC/CE): 7.3.18, 8.3.7, 9.6.4, 9.7.2, 9.8.0

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-tele-ce-filewrite

Get alerted when CVE-2019-15962 or the next vulnerability affects your stack