Privilege Escalation in Cisco Expressway Series and TelePresence VCS Management Interfaces

CVE-2023-20105

Summary

A significant vulnerability is present in the password change functionality of Cisco Expressway Series devices and Cisco TelePresence Video Communication Server. This issue stems from improper management of password change requests, allowing authenticated users with Read-only credentials to exploit the system. By sending a specially crafted request through the web management interface, an attacker could gain the ability to alter passwords for any user account, including those with administrative privileges. This breach not only compromises user accounts but also poses the risk of impersonation of legitimate users, further endangering the system's security.

References