Global infos:

A vulnerability in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. This vulnerability is due to improper access controls on files that are on the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit this vulnerability, an attacker would need to have a remote support user account. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVE Status: Awaiting Analysis

References:

[email protected]

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	LOCAL
Availability Impact	LOW
Base Score	5.1
Base Severity	MEDIUM
Confidentiality Impact	NONE
Integrity Impact	HIGH
Privileges Required	HIGH
Scope	UNCHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Exploitability Score	0.8
Impact Score	4.2
Source	[email protected]
Type	Primary

Links:

Exploit-db
Github