cisco-sa-CTT-DAV-HSvEHHEt

Cisco Touch 10 Devices Downgrade Vulnerability

view advisory published 2022-10-05

A vulnerability in the version control of Cisco TelePresence CE Software for Cisco Touch 10 Devices could allow an unauthenticated, adjacent attacker to install an older version of the software on an affected device. This vulnerability is due to insufficient version control. An attacker could exploit this vulnerability by installing an older version of Cisco TelePresence CE Software on an affected device. A successful exploit could allow the attacker to take advantage of vulnerabilities in older versions of the software. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-20931US	—	0.27% (20th)	—	2024-11-15
A vulnerability in the version control of Cisco TelePresence CE Software for Cisco Touch 10 Devices could allow an unauthenticated, adjacent attacker to install an older…

references

External citations — patches, advisories, analysis.

Cisco Touch 10 Devices Downgrade Vulnerabilityself
Cisco Security Vulnerability Policyexternal
considering software upgradesexternal
Cisco Security Advisories pageexternal

remediations (1)

FixedCisco TelePresence Endpoint Software (TC/CE)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan