CVE-2023-20209 (telepresence_video_communication_server)

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit …

application attack cisco code code execution command command injection communication cve device expressway injection injection attack input interface management privileges remote code remote code execution result series server telepresence telepresence video communication server the web validation video vulnerability web