What is the CVSS score of CVE-2020-3143?

CVE-2020-3143 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 8.5%.

Webex Board 55 Firmware CVE-2020-3143

HIGH

Path Traversal (CWE-22)

2020-09-23 psirt@cisco.com

Path Traversal Cisco Webex Board 55 Firmware Webex Board 55S Firmware Webex Board 70 Firmware Webex Board 70S Firmware Webex Board 85S Firmware Webex Dx70 Firmware Webex Dx80 Firmware Webex Room 55 Firmware Webex Room 70 Firmware Telepresence Codec C40 Firmware Telepresence Codec C60 Firmware Telepresence Codec C90 Firmware Ex60 Firmware Ex90 Firmware Sx10 Firmware Sx20 Firmware Sx80 Firmware Telepresence Mx200 Firmware Telepresence Mx300 Firmware Telepresence Mx700 Firmware Telepresence Mx800 Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 23, 2020 - 01:15 nvd

HIGH 7.2

DescriptionNVD

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the xAPI of the affected software. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the system. To exploit this vulnerability, an attacker would need either an In-Room Control or administrator account.

AnalysisAI

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco RoomOS Software could allow an. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the xAPI of the affected software. An attacker could exploit this vulnerability by sending a crafted request to the xAPI. A successful exploit could allow the attacker to read and write arbitrary files in the system. To exploit this vulnerability, an attacker would need either an In-Room Control or administrator account. Affected products include: Cisco Ex60 Firmware, Cisco Ex90 Firmware, Cisco Sx10 Firmware, Cisco Sx20 Firmware, Cisco Sx80 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.