CVE-2023-20209: Cisco Telepresence Video Communication Server

High severity, CVSS 7.2. EPSS: 40.8% chance of exploitation in the next 30 days.

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges.

Affected products

• Cisco Telepresence Video Communication Server: before 14.3.1 (fixed in 14.3.1)

Published 2023-08-16. Last modified 2026-06-17.