TI-2015-00611 Aliases CVE-2015-0660 GHSA-hc47-w8mm-qg2f

Cisco Virtual TelePresence Server Software does not properly restrict use of the serial…

LOW 32CWE-284Published 2015-03-14 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.

Why it matters now

EPSS 0.00352 29th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:telepresence_server_software::::::::	all versions	Vulnerable	Cisco

cpe:2.3:a:cisco:telepresence_server_software:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-0660
2026-10-03 Alias added: GHSA-hc47-w8mm-qg2f

References

Advisory 1

20150312 Cisco Virtual TelePresence Server Serial Console Privileged Access

TI-2015-00664 The web framework in Cisco TelePresence Advanced Media Gateway Series Software before… CVSS 2.0HIGH 9.0
TI-2015-05271 Buffer overflow in the Conference Control Protocol API implementation in Cisco… CVSS 2.0HIGH 7.8
TI-2013-01022 The DSP card on Cisco TelePresence MCU 4500 and 4501 devices before 4.3(2.30)… CVSS 2.0HIGH 7.1
TI-2015-05291 Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software… CVSS 2.0MEDIUM 6.8
TI-2017-02913 Cleartext transmission of sensitive information in Cisco TelePresence Server CVSS 3.0MEDIUM 5.3
TI-2014-02659 Multiple cross-site scripting (XSS) vulnerabilities in the login page in the… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences