CVE-2021-34715 Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability

Medium 4.7 Published 18 Aug 2021 Updated 7 Nov 2024

Authenticated attackers can execute arbitrary code with user-level privileges by uploading malicious upgrade packages to the administrative interface.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-34715?

CVE-2021-34715 is a medium-severity code injection vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway, published on 18 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system.

Weakness: CWE-347

Which versions are affected by CVE-2021-34715?

It affects 2 products.

Products include Cisco Expressway, Cisco Telepresence Video Communication Server.

How do I fix CVE-2021-34715?

No fix has been published for CVE-2021-34715 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-34715 being exploited?

There is no known exploitation of CVE-2021-34715 in the wild and no public exploit code.

Sources

Also known as GHSA-p7w3-xcqr-pr4r.