Skip to main content

Telepresence System Tx9000 CVE-2013-3454

CRITICAL
Credentials Management Errors (CWE-255)
2013-08-08 psirt@cisco.com
Cisco Authentication Bypass Telepresence System Tx9000 Telepresence System Tx9200 Telepresence System Software Telepresence System 1300 Telepresence System 1300 65 Telepresence System 3000 Telepresence System 3010 Telepresence System 3200 Telepresence System 3210 Telepresence System 500 32 Telepresence System 500 37
10.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
10.0 CRITICAL
AV:N/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:C/A:C
Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
C
Availability
C

Lifecycle Timeline

1
CVE Published
Aug 08, 2013 - 14:55 cve.org
CRITICAL 10.0

DescriptionCVE.org

Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which makes it easier for remote attackers to modify the configuration or perform arbitrary actions via HTTPS requests, aka Bug ID CSCui43128.

AnalysisAI

Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-255. Cisco TelePresence System Software 1.10.1 and earlier on 500, 13X0, 1X00, 30X0, and 3X00 devices, and 6.0.3 and earlier on TX 9X00 devices, has a default password for the pwrecovery account, which makes it easier for remote attackers to modify the configuration or perform arbitrary actions via HTTPS requests, aka Bug ID CSCui43128. Affected products include: Cisco Telepresence System Tx9000, Cisco Telepresence System Tx9200, Cisco Telepresence System Software, Cisco Telepresence System 1300, Cisco Telepresence System 1300-65.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Telepresence System Tx9000

View all
CVE-2012-3075 CRITICAL
9.0 Jul 12

The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticat
CVE-2014-0661 HIGH
8.3 Jan 22

The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42
CVE-2012-2486 HIGH
8.3 Jul 12

The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresen
CVE-2012-3074 HIGH
8.3 Jul 12

An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbi
CVE-2012-3073 HIGH
7.8 Jul 12

The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manager before 1.9.0, and

Same weakness CWE-255 – Credentials Management Errors

View all
CVE-2014-1812 HIGH POC
8.8
CVE-2016-7456 CRITICAL POC
9.8
CVE-2012-1493 HIGH POC
7.8
CVE-2012-4933 HIGH POC
7.8
CVE-2013-4786 HIGH POC
7.5
CVE-2013-3502 MEDIUM POC
6.5
CVE-2015-7251 CRITICAL POC
9.8
CVE-2013-6884 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2013-3454 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy