Cisco TelePresence Management Suite Simple Object Access Protocol Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this vulnerability by gaining access to internal, trusted networks to send crafted SOAP calls to the affected device. If successful, an exploit could allow the attacker to access system management tools. Under normal circumstances, this access should be prohibited.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco TelePresence Management Suite (TMS) | all versions | — | No fix listed | CNA |
- Cisco TelePresence Management Suite (TMS) VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:telepresence_management_suite:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.2.1:*:*:*:*:*:*:* | 15.2.1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.3:*:*:*:*:*:*:* | 15.3 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.4:*:*:*:*:*:*:* | 15.4 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.5:*:*:*:*:*:*:* | 15.5 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.6:*:*:*:*:*:*:* | 15.6 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_management_suite:15.7:*:*:*:*:*:*:* | 15.7 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:telepresence_management_suite:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.2.1:*:*:*:*:*:*:* Versions 15.2.1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.3:*:*:*:*:*:*:* Versions 15.3 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.4:*:*:*:*:*:*:* Versions 15.4 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.5:*:*:*:*:*:*:* Versions 15.5 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.6:*:*:*:*:*:*:* Versions 15.6 Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_management_suite:15.7:*:*:*:*:*:*:* Versions 15.7 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1660
- 2026-10-03 Alias added: GHSA-58c5-wgv2-v53h
References
More Cisco Telepresence Management Suite vulnerabilities
- TI-2019-01287 Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability CVSS 3.0MEDIUM 6.1
- TI-2018-11027 Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability CVSS 3.0MEDIUM 6.1
- TI-2024-13268 Improper input validation in Cisco TelePresence Management Suite CVSS 3.1MEDIUM 5.5
- TI-2020-02746 Cisco TelePresence Management Suite Stored Cross-Site Scripting Vulnerability CVSS 3.1MEDIUM 5.4
- TI-2013-01072 TMSSNMPService.exe in TelePresence Manager in Cisco TelePresence Management Suite (TMS)… CVSS 2.0MEDIUM 5.0
- TI-2025-14508 Cross-site scripting in Cisco TelePresence Management Suite CVSS 3.1MEDIUM 5.4
Sources
- CVE-2019-1660 · CVE Program
- CVE-2019-1660 · NVD
- FIRST EPSS
- GHSA-58c5-wgv2-v53h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences