A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbi…

Published 9 y ago 2017-05-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

3.6%

percentile 90%

Public exploits

none known

A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote attacker to access arbitrary files on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using directory traversal techniques to read files within the Cisco TelePresence IX5000 Series filesystem. This vulnerability affects Cisco TelePresence IX5000 Series devices running software version 8.2.0. Cisco Bug IDs: CSCvc52325.

Exploit prediction (EPSS)

3.60% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Affected products

n/a Cisco TelePresence IX5000 Series

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-20 Improper Input Validation

References

securityfocus.com /bid/98519 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1038509 · vdb-entry, x_refsource_SECTRACK, x_transferred
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-telepresence-ix5000 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-6652
NVD: CVE-2017-6652

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.