What is the CVSS score of CVE-2014-0661?

CVE-2014-0661 has a CVSS 2.0 base score of 8.3 (High). CVSS vector: AV:A/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 4.0%.

Telepresence System Software CVE-2014-0661

HIGH

Code Injection (CWE-94)

2014-01-22 psirt@cisco.com

Denial Of Service Buffer Overflow Cisco Code Injection RCE Telepresence System Software Telepresence System 1000 Telepresence System 1300 65 Telepresence System 3000 Telepresence System 3010 Telepresence System 3200 Telepresence System 3210 Telepresence System 500 37 Telepresence System 1100 Telepresence System 500 32 Telepresence System Tx1300 47 Telepresence System Tx1310 65 Telepresence System Tx9000 Telepresence System Tx9200

8.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:A/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:A/AC:L/Au:N/C:C/I:C/A:C

Attack Vector

Adjacent

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jan 22, 2014 - 21:55 cve.org

HIGH 8.3

DescriptionCVE.org

The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.

AnalysisAI

The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote. Rated high severity (CVSS 8.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796. Affected products include: Cisco Telepresence System Software, Cisco Telepresence System 1000, Cisco Telepresence System 1300-65, Cisco Telepresence System 3000, Cisco Telepresence System 3010. Version information: before 1.10.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.