Cisco Expressway Series and Cisco TelePresence Video Communication Server Remote Code Execution Vulnerability

Vulnerability

A remote code execution vulnerability exists in the administrative web interface of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software. The vulnerability is due to insufficient validation of the content of upgrade packages during the upload process. An authenticated attacker can upload a malicious archive to the Upgrade page, leading to code execution on the underlying operating system. Affected versions include a range of releases; specific versions are detailed in Cisco bug IDs referenced in the advisory [1].

Exploitation

An attacker must have valid administrative credentials to access the web interface [1]. The attack is performed remotely over the network by uploading a specially crafted archive file to the Upgrade page. No user interaction beyond the attacker's own actions is required, and the exploitation does not require any race window [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with user-level privileges on the underlying operating system. This can lead to full compromise of the affected device, including information disclosure, modification of system files, and potential further lateral movement within the network [1].

Mitigation

Cisco has released fixed software versions to address this vulnerability. Per the advisory, customers should upgrade to the appropriate fixed release as indicated in the Cisco bug IDs at the top of the advisory [1]. No workarounds are available [1]. If upgrading is not immediately possible, restrict access to the administrative web interface to trusted IP addresses as a partial mitigation.