CVE-2022-20813 CRITICAL

CVE-2022-20813: Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

Vendor Cisco
Product Cisco TelePresence Video Communication Server (VCS) Expressway
Weakness CWE-158
Published July 6, 2022
Last update November 6, 2024
View on NVD All CVEs

CVSS base score

9.0/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory.

Key dates

02Disclosure timeline

July 6, 2022 CVE published
November 6, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-66263 Unauthenticated Arbitrary File Read via Null Byte Injection CVE-2025-55113 BMC Control-M/Agent unescaped NULL byte in access control list checks CVE-2026-4359 Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer CVE-2024-10921 Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server CVE-2026-33191 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error