Vulnerability · Published Nov 6, 2020 · Assigned by cisco

CVE-2020-26086Cisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability

Medium 4.3

In plain English

A medium-severity security flaw in Cisco TelePresence Endpoint Software (TC/CE) from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.8%top 41.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected device. An attacker could exploit this vulnerability by accessing information that should not be accessible to users with low privileges. A successful exploit could allow the attacker to gain access to sensitive information.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco TelePresence Endpoint Software (TC/CE)	n/a

Weakness: CWE-668 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

20201104 Cisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability vendor-advisory, x_refsource_CISCO