{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-20793", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2021-11-02T13:28:29.168Z", "datePublished": "2024-11-15T15:34:33.919Z", "dateUpdated": "2024-11-15T21:12:23.388Z"}, "containers": {"cna": {"title": "Cisco Touch 10 Device Insufficient Identity Verification Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device.\r\nThis vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj", "name": "cisco-sa-CTT-IVV-4A66Dsfj"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-CTT-IVV-4A66Dsfj", "discovery": "INTERNAL", "defects": ["CSCvw08723"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Required Cryptographic Step", "type": "cwe", "cweId": "CWE-325"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco RoomOS Software", "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Cisco", "product": "Cisco TelePresence Endpoint Software (TC/CE)", "versions": [{"version": "CE9.10.2", "status": "affected"}, {"version": "CE9.1.4", "status": "affected"}, {"version": "CE9.10.3", "status": "affected"}, {"version": "CE9.1.5", "status": "affected"}, {"version": "CE9.10.1", "status": "affected"}, {"version": "CE9.13.0", "status": "affected"}, {"version": "CE9.1.1", "status": "affected"}, {"version": "CE9.9.4", "status": "affected"}, {"version": "CE9.2.1", "status": "affected"}, {"version": "CE9.1.3", "status": "affected"}, {"version": "CE9.1.6", "status": "affected"}, {"version": "CE9.12.3", "status": "affected"}, {"version": "CE9.13.1", "status": "affected"}, {"version": "CE9.12.4", "status": "affected"}, {"version": "CE9.14.3", "status": "affected"}, {"version": "CE9.14.4", "status": "affected"}, {"version": "CE9.13.2", "status": "affected"}, {"version": "CE9.12.5", "status": "affected"}, {"version": "CE9.14.5", "status": "affected"}, {"version": "CE9.15.0.10", "status": "affected"}, {"version": "CE9.15.0.11", "status": "affected"}, {"version": "CE9.13.3", "status": "affected"}, {"version": "CE9.15.0.13", "status": "affected"}, {"version": "CE9.14.6", "status": "affected"}, {"version": "CE9.15.3.17", "status": "affected"}, {"version": "CE9.14.7", "status": "affected"}, {"version": "CE9.15.0.19", "status": "affected"}, {"version": "CE9.15.3.19", "status": "affected"}, {"version": "CE9.15.3.18", "status": "affected"}, {"version": "CE9.0.1", "status": "affected"}, {"version": "CE9.2.2", "status": "affected"}, {"version": "CE9.1.2", "status": "affected"}, {"version": "CE9.9.3", "status": "affected"}, {"version": "CE9.2.4", "status": "affected"}, {"version": "CE9.2.3", "status": "affected"}, {"version": "CE9.15.3.22", "status": "affected"}, {"version": "CE9.15.8.12", "status": "affected"}, {"version": "CE9.15.10.8", "status": "affected"}, {"version": "CE9.15.3.26", "status": "affected"}, {"version": "CE9.15.3.25", "status": "affected"}, {"version": "CE9.15.13.0", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-11-15T15:34:33.919Z"}}, "adp": [{"affected": [{"vendor": "cisco", "product": "roomos", "cpes": ["cpe:2.3:o:cisco:roomos:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "cisco", "product": "telepresence_tc_software", "cpes": ["cpe:2.3:a:cisco:telepresence_tc_software:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "cisco", "product": "telepresence_ce_software", "cpes": ["cpe:2.3:a:cisco:telepresence_ce_software:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "*", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-15T21:07:36.103341Z", "id": "CVE-2022-20793", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T21:12:23.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-20793", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-15T21:07:36.103341Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:cisco:roomos:*:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "roomos", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:cisco:telepresence_tc_software:*:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "telepresence_tc_software", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:cisco:telepresence_ce_software:*:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "telepresence_ce_software", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T21:12:14.431Z"}}], "cna": {"title": "Cisco Touch 10 Device Insufficient Identity Verification Vulnerability", "source": {"defects": ["CSCvw08723"], "advisory": "cisco-sa-CTT-IVV-4A66Dsfj", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco RoomOS Software", "versions": [{"status": "affected", "version": "N/A"}]}, {"vendor": "Cisco", "product": "Cisco TelePresence Endpoint Software (TC/CE)", "versions": [{"status": "affected", "version": "CE9.10.2"}, {"status": "affected", "version": "CE9.1.4"}, {"status": "affected", "version": "CE9.10.3"}, {"status": "affected", "version": "CE9.1.5"}, {"status": "affected", "version": "CE9.10.1"}, {"status": "affected", "version": "CE9.13.0"}, {"status": "affected", "version": "CE9.1.1"}, {"status": "affected", "version": "CE9.9.4"}, {"status": "affected", "version": "CE9.2.1"}, {"status": "affected", "version": "CE9.1.3"}, {"status": "affected", "version": "CE9.1.6"}, {"status": "affected", "version": "CE9.12.3"}, {"status": "affected", "version": "CE9.13.1"}, {"status": "affected", "version": "CE9.12.4"}, {"status": "affected", "version": "CE9.14.3"}, {"status": "affected", "version": "CE9.14.4"}, {"status": "affected", "version": "CE9.13.2"}, {"status": "affected", "version": "CE9.12.5"}, {"status": "affected", "version": "CE9.14.5"}, {"status": "affected", "version": "CE9.15.0.10"}, {"status": "affected", "version": "CE9.15.0.11"}, {"status": "affected", "version": "CE9.13.3"}, {"status": "affected", "version": "CE9.15.0.13"}, {"status": "affected", "version": "CE9.14.6"}, {"status": "affected", "version": "CE9.15.3.17"}, {"status": "affected", "version": "CE9.14.7"}, {"status": "affected", "version": "CE9.15.0.19"}, {"status": "affected", "version": "CE9.15.3.19"}, {"status": "affected", "version": "CE9.15.3.18"}, {"status": "affected", "version": "CE9.0.1"}, {"status": "affected", "version": "CE9.2.2"}, {"status": "affected", "version": "CE9.1.2"}, {"status": "affected", "version": "CE9.9.3"}, {"status": "affected", "version": "CE9.2.4"}, {"status": "affected", "version": "CE9.2.3"}, {"status": "affected", "version": "CE9.15.3.22"}, {"status": "affected", "version": "CE9.15.8.12"}, {"status": "affected", "version": "CE9.15.10.8"}, {"status": "affected", "version": "CE9.15.3.26"}, {"status": "affected", "version": "CE9.15.3.25"}, {"status": "affected", "version": "CE9.15.13.0"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj", "name": "cisco-sa-CTT-IVV-4A66Dsfj"}], "descriptions": [{"lang": "en", "value": "A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device.\r\nThis vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-325", "description": "Missing Required Cryptographic Step"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-11-15T15:34:33.919Z"}}}, "cveMetadata": {"cveId": "CVE-2022-20793", "state": "PUBLISHED", "dateUpdated": "2024-11-15T21:12:23.388Z", "dateReserved": "2021-11-02T13:28:29.168Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-11-15T15:34:33.919Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device.\r\nThis vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de emparejamiento del software Cisco TelePresence CE y el software RoomOS para dispositivos Cisco Touch 10 podr\u00eda permitir que un atacante remoto no autenticado se haga pasar por un dispositivo leg\u00edtimo y se empareje con un dispositivo afectado. Esta vulnerabilidad se debe a una verificaci\u00f3n de identidad insuficiente. Un atacante podr\u00eda aprovechar esta vulnerabilidad haci\u00e9ndose pasar por un dispositivo leg\u00edtimo y respondiendo a la transmisi\u00f3n de emparejamiento de un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante acceder al dispositivo afectado mientras se hace pasar por un dispositivo leg\u00edtimo. No existen workarounds que aborden esta vulnerabilidad."}], "id": "CVE-2022-20793", "lastModified": "2024-11-18T17:11:56.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "ykramarz@cisco.com", "type": "Primary"}]}, "published": "2024-11-15T16:15:22.370", "references": [{"source": "ykramarz@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-325"}], "source": "ykramarz@cisco.com", "type": "Primary"}]}

{}