CVE-2022-20931 Cisco Touch 10 Device Downgrade Attack Vulnerability

Medium 6.5 Published 15 Nov 2024 Updated 15 Nov 2024

An adjacent attacker can downgrade Cisco Touch 10 software to exploit known vulnerabilities in older versions, bypassing security controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-20931?

CVE-2022-20931 is a medium-severity vulnerability in Cisco TelePresence Endpoint Software (TC/CE), published on 15 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the version control of Cisco TelePresence CE Software for Cisco Touch 10 Devices could allow an unauthenticated, adjacent attacker to install an older version of the software on an affected device. This vulnerability is due to insufficient version control. An attacker could exploit this vulnerability by installing an older version of Cisco TelePresence CE Software on an affected device. A successful exploit could allow the attacker to take advantage of vulnerabilities in older versions of the software.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Weakness: CWE-527

Which versions are affected by CVE-2022-20931?

It affects 1 product.

Products include Cisco Telepresence Collaboration Endpoint.

How do I fix CVE-2022-20931?

No fix has been published for CVE-2022-20931 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-20931 being exploited?

There is no known exploitation of CVE-2022-20931 in the wild and no public exploit code.

Sources

Also known as GHSA-92gj-2wf7-h87v.