CVE-2014-0661 Code injection in n/a
Remote attackers can execute arbitrary commands or cause denial of service in Cisco TelePresence systems via crafted XML-RPC messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-0661?
CVE-2014-0661 is a high-severity code injection vulnerability in n/a, published on 22 Jan 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The System Status Collection Daemon (SSCD) in Cisco TelePresence System 500-37, 1000, 1300-65, and 3xxx before 1.10.2(42), and 500-32, 1300-47, TX1310 65, and TX9xxx before 6.0.4(11), allows remote attackers to execute arbitrary commands or cause a denial of service (stack memory corruption) via a crafted XML-RPC message, aka Bug ID CSCui32796.
Weakness: CWE-94
Which versions are affected by CVE-2014-0661?
It affects 14 products.
Products include Cisco Telepresence System 1000, Cisco Telepresence System 1100, Cisco Telepresence System 1300-65, Cisco Telepresence System 3000, Cisco Telepresence System 3010, Cisco Telepresence System 3200 and 8 more.
How do I fix CVE-2014-0661?
No fix has been published for CVE-2014-0661 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2014-0661 being exploited?
There is no known exploitation of CVE-2014-0661 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7g4g-9h43-3xvc.