CVE-2013-3379 Auth bypass in n/a

High 8.3 Published 21 Jun 2013 Updated 16 Sep 2024

Remote attackers on the management network can bypass firewall rules to gain root shell access on Cisco TelePresence devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2013-3379?

CVE-2013-3379 is a high-severity authentication bypass vulnerability in n/a, published on 21 Jun 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The firewall subsystem in Cisco TelePresence TC Software before 4.2 does not properly implement rules that grant access to hosts, which allows remote attackers to obtain shell access with root privileges by leveraging connectivity to the management network, aka Bug ID CSCts37781.

Weakness: CWE-264

Which versions are affected by CVE-2013-3379?

It affects 1 product.

Products include Cisco Telepresence Tc Software.

How do I fix CVE-2013-3379?

No fix has been published for CVE-2013-3379 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2013-3379 being exploited?

There is no known exploitation of CVE-2013-3379 in the wild and no public exploit code.

Sources

Also known as GHSA-h3x8-v5rw-g7h2.