Cisco IP Video Phone E20 Default Root Certificate verification Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
Cisco IP Video Phone E20 TE 4.1.0
Unaffected system:
Cisco IP Video Phone E20 TE 4.1.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51541
Cve id: CVE-2011-4659

Cisco IP Video Phone E20 is a security solution for Video Conferencing Systems, online audio and Video streaming recording, and consulting.

The Cisco IP Video Phone E20 has a verification credential bypass vulnerability in admin and root authentication. Attackers can exploit this vulnerability to obtain illegal access permissions of the affected devices, resulting in DOS. This problem occurs when the Cisco internal system number is Cisco bug ID CSCtw69889.

<* Source: Cisco

Link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120118-te
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Cisco
-----
Cisco has released a Security Bulletin (cisco-sa-20120118-te) and patches for this:

Cisco-sa-20120118-te: Cisco IP Video Phone E20 Default Root Account

Link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120118-te