CVE-2023-20105

CVE-2023-20105 is a privilege escalation vulnerability in the change password functionality of Cisco Expressway Series and TelePresence Video Communication Server (VCS). An authenticated, remote attacker with Read-only credentials can exploit this flaw by sending a crafted request to the web-based management interface. Successful exploitation allows the attacker to alter any user's password, including administrative accounts, thereby gaining Administrator privileges. This vulnerability has a CVSS score of 6.5 (Medium) and is rated as a FAUCET Risk Score of 35/100. The attack vector is network-based with low attack complexity, requiring only low privileges and no user interaction, leading to a high impact on integrity. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. While there has been some community discussion and media coverage, it is not considered a "Hot List" CVE.