What is the CVSS score of CVE-2015-4330?

CVE-2015-4330 has a CVSS 2.0 base score of 6.9 (Medium). CVSS vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.2%.

Telepresence Video Communication Server Software CVE-2015-4330

MEDIUM

OS Command Injection (CWE-78)

2015-09-02 psirt@cisco.com

Command Injection Cisco Telepresence Video Communication Server Software

6.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

AV:L/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 02, 2015 - 16:59 cve.org

MEDIUM 6.9

DescriptionCVE.org

A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556.

AnalysisAI

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556. Affected products include: Cisco Telepresence Video Communication Server Software.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.