Some vulnerabilities have been reported in Cisco TelePresence Immersive Endpoint devices, which can be exploited by malicious users and malicious people to compromise a vulnerable system.

1) An error within a Cisco TelePresence API can be exploited to inject and execute arbitrary commands via a specially crafted request to TCP port 61480.

2) An error exists within the handling of Cisco Discovery Protocol (CDP) packets.

For more information see vulnerability#2 in:
SA49864

The vulnerabilities #1 and #2 are reported in in Cisco TelePresence Immersive Endpoint devices versions 1.6 and prior, 1.7, and 1.8.

3) An error within the administrative web interface can be exploited to inject and execute arbitrary commands by sending a specially crafted request to TCP port 443.

This vulnerability is reported in Cisco TelePresence Immersive Endpoint devices versions 1.6 and prior and 1.7.

Solution
Update Cisco TelePresence Immersive Endpoint devices to version 1.9.1.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers