CVE-2022-20793

{"id": "CVE-2022-20793", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2024-11-15T16:15:22.370", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj", "source": "ykramarz@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-325"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device.\r\nThis vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de emparejamiento del software Cisco TelePresence CE y el software RoomOS para dispositivos Cisco Touch 10 podr\u00eda permitir que un atacante remoto no autenticado se haga pasar por un dispositivo leg\u00edtimo y se empareje con un dispositivo afectado. Esta vulnerabilidad se debe a una verificaci\u00f3n de identidad insuficiente. Un atacante podr\u00eda aprovechar esta vulnerabilidad haci\u00e9ndose pasar por un dispositivo leg\u00edtimo y respondiendo a la transmisi\u00f3n de emparejamiento de un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante acceder al dispositivo afectado mientras se hace pasar por un dispositivo leg\u00edtimo. No existen workarounds que aborden esta vulnerabilidad."}], "lastModified": "2024-11-18T17:11:56.587", "sourceIdentifier": "ykramarz@cisco.com"}