Refine your search
33 vulnerabilities found for Cisco TelePresence Video Communication Server (VCS) Expressway by Cisco
CVE-2026-76497 (GCVE-0-2026-76497)
Vulnerability from cvelistv5
Published
2026-10-21 16:18
Modified
2026-10-22 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-377 - Insecure Temporary File
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76497 are related to issues concerning insecure temporary files that are grouped under the Common Weakness Enumeration (CWE) Base CWE-377.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T17:11:28.451935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:51.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76497 are related to issues concerning insecure temporary files that are grouped under the Common Weakness Enumeration (CWE) Base CWE-377."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-377",
"description": "Insecure Temporary File",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:18:13.854Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67924"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76497",
"datePublished": "2026-10-21T16:18:13.854Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T13:37:51.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76496 (GCVE-0-2026-76496)
Vulnerability from cvelistv5
Published
2026-10-21 16:18
Modified
2026-10-22 23:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T23:04:51.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:18:03.087Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67922"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76496",
"datePublished": "2026-10-21T16:18:03.087Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T23:04:51.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76495 (GCVE-0-2026-76495)
Vulnerability from cvelistv5
Published
2026-10-21 16:17
Modified
2026-10-22 23:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T23:04:50.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:17:58.451Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67926"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76495",
"datePublished": "2026-10-21T16:17:58.451Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T23:04:50.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76494 (GCVE-0-2026-76494)
Vulnerability from cvelistv5
Published
2026-10-21 16:17
Modified
2026-10-22 23:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T23:04:49.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:17:44.657Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67925"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76494",
"datePublished": "2026-10-21T16:17:44.657Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T23:04:49.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76493 (GCVE-0-2026-76493)
Vulnerability from cvelistv5
Published
2026-10-21 16:17
Modified
2026-10-22 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-248 - Uncaught Exception
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T17:14:24.690060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:52.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:17:34.243Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67921"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76493",
"datePublished": "2026-10-21T16:17:34.243Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T13:37:52.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76490 (GCVE-0-2026-76490)
Vulnerability from cvelistv5
Published
2026-10-21 16:17
Modified
2026-10-22 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76490",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T17:14:36.090879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:52.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:17:29.557Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67928"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76490",
"datePublished": "2026-10-21T16:17:29.557Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T13:37:52.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76492 (GCVE-0-2026-76492)
Vulnerability from cvelistv5
Published
2026-10-21 16:17
Modified
2026-10-22 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-476 - NULL Pointer Dereference
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T13:21:16.254332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:53.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:17:14.565Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67927"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76492",
"datePublished": "2026-10-21T16:17:14.565Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T13:37:53.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76491 (GCVE-0-2026-76491)
Vulnerability from cvelistv5
Published
2026-10-21 16:17
Modified
2026-10-22 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-617 - Reachable Assertion
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76491",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T17:15:05.406749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:53.379Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:17:04.407Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-exwy-hardening-FhcqBVcs",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
}
],
"source": {
"advisory": "cisco-sa-exwy-hardening-FhcqBVcs",
"defects": [
"CSCww67923"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76491",
"datePublished": "2026-10-21T16:17:04.407Z",
"dateReserved": "2026-08-19T12:02:03.640Z",
"dateUpdated": "2026-10-22T13:37:53.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76435 (GCVE-0-2026-76435)
Vulnerability from cvelistv5
Published
2026-10-21 16:14
Modified
2026-10-22 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
Summary
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.
This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access.
Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T13:22:06.316293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:37:54.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.\r\n\r\nThis vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:14:19.230Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-inf-disc-vvYqgSTS",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS"
}
],
"source": {
"advisory": "cisco-sa-expressway-inf-disc-vvYqgSTS",
"defects": [
"CSCww11368"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Expressway Series Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76435",
"datePublished": "2026-10-21T16:14:19.230Z",
"dateReserved": "2026-08-19T12:02:03.634Z",
"dateUpdated": "2026-10-22T13:37:54.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76466 (GCVE-0-2026-76466)
Vulnerability from cvelistv5
Published
2026-10-21 16:14
Modified
2026-10-22 23:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-798 - Use of Hard-coded Credentials
Summary
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.
This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.
Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 Version: X15.2.2 Version: X15.2.3 Version: X14.3.7 Version: X15.2.4. Version: X15.2.4 Version: X15.3.0 Version: X15.3.1 Version: X15.3.2 Version: X15.4.0 Version: X15.5.0 Version: X15.5.1 Version: X15.5.2 Version: X15.5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76466",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T23:04:48.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
},
{
"status": "affected",
"version": "X15.2.2"
},
{
"status": "affected",
"version": "X15.2.3"
},
{
"status": "affected",
"version": "X14.3.7"
},
{
"status": "affected",
"version": "X15.2.4."
},
{
"status": "affected",
"version": "X15.2.4"
},
{
"status": "affected",
"version": "X15.3.0"
},
{
"status": "affected",
"version": "X15.3.1"
},
{
"status": "affected",
"version": "X15.3.2"
},
{
"status": "affected",
"version": "X15.4.0"
},
{
"status": "affected",
"version": "X15.5.0"
},
{
"status": "affected",
"version": "X15.5.1"
},
{
"status": "affected",
"version": "X15.5.2"
},
{
"status": "affected",
"version": "X15.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as\u0026nbsp;root.\r\n\r\nThis vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T16:14:19.225Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-vcs-static-cred-hr7EWZ8t",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
}
],
"source": {
"advisory": "cisco-sa-vcs-static-cred-hr7EWZ8t",
"defects": [
"CSCww27732"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Expressway Series Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76466",
"datePublished": "2026-10-21T16:14:19.225Z",
"dateReserved": "2026-08-19T12:02:03.638Z",
"dateUpdated": "2026-10-22T23:04:48.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20179 (GCVE-0-2025-20179)
Vulnerability from cvelistv5
Published
2025-02-05 16:14
Modified
2025-02-05 17:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 Version: X15.2.0 Version: X15.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-05T17:20:57.716321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T17:21:13.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
},
{
"status": "affected",
"version": "X15.2.0"
},
{
"status": "affected",
"version": "X15.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.\r\nNote:\u0026nbsp;Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T16:14:03.704Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-xss-uexUZrEW",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-xss-uexUZrEW"
}
],
"source": {
"advisory": "cisco-sa-expressway-xss-uexUZrEW",
"defects": [
"CSCwn01191"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Expressway Series Cross-Site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20179",
"datePublished": "2025-02-05T16:14:03.704Z",
"dateReserved": "2024-10-10T19:15:13.225Z",
"dateUpdated": "2025-02-05T17:21:13.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20814 (GCVE-0-2022-20814)
Vulnerability from cvelistv5
Published
2024-11-15 15:32
Modified
2024-11-15 21:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-295 - Improper Certificate Validation
Summary
A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic.
Note: Cisco Expressway-E is not affected by this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:telepresence_video_communication_server:-:*:*:*:expressway:*:*:*"
],
"defaultStatus": "unknown",
"product": "telepresence_video_communication_server",
"vendor": "cisco",
"versions": [
{
"lessThan": "14.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-15T21:14:32.828966Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T21:15:35.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the certificate validation of Cisco\u0026nbsp;Expressway-C and Cisco\u0026nbsp;TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data.\u0026nbsp;\u0026nbsp;The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco\u0026nbsp;Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic.\r\nNote: Cisco\u0026nbsp;Expressway-E is not affected by this vulnerability.Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco\u00a0PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T15:32:47.058Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-sqpsSfY6",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt\u003c/a\u003e\u003c/p\u003e\u003cp\u003eThis advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\"\u003eCisco\u0026nbsp;Event Response: September 2022 Semiannual Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6\u003c/a\u003e\u003c/p\u003e\u003cp\u003eThis advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\"\u003eCisco\u0026nbsp;Event Response: September 2022 Semiannual Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2\u003c/a\u003e\u003c/p\u003e\u003cp\u003eThis advisory is part of the September 2022 release of the Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see \u003ca href=\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74840\"\u003eCisco\u0026nbsp;Event Response: September 2022 Semiannual Cisco\u0026nbsp;IOS XR Software Security Advisory Bundled Publication",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2"
}
],
"source": {
"advisory": "cisco-sa-expressway-csrf-sqpsSfY6",
"defects": [
"CSCwa25108"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20814",
"datePublished": "2024-11-15T15:32:47.058Z",
"dateReserved": "2021-11-02T13:28:29.175Z",
"dateUpdated": "2024-11-15T21:15:35.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20853 (GCVE-0-2022-20853)
Vulnerability from cvelistv5
Published
2024-11-15 15:27
Modified
2024-11-15 16:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.4:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.5:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.6:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.7:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.8:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.5.9:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.6.4:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x12.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x14.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.10.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.10.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.10.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.10.4:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.11.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.11.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.11.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.11.4:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.5.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.6:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.7:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.7.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.8:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.8.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.8.3:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.9:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server:x8.9.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.5.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "telepresence_video_communication_server_software",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "x12.5.0"
},
{
"status": "affected",
"version": "x12.5.1"
},
{
"status": "affected",
"version": "x12.5.2"
},
{
"status": "affected",
"version": "x12.5.3"
},
{
"status": "affected",
"version": "x12.5.4"
},
{
"status": "affected",
"version": "x12.5.5"
},
{
"status": "affected",
"version": "x12.5.6"
},
{
"status": "affected",
"version": "x12.5.7"
},
{
"status": "affected",
"version": "x12.5.8"
},
{
"status": "affected",
"version": "x12.5.9"
},
{
"status": "affected",
"version": "x12.6.0"
},
{
"status": "affected",
"version": "x12.6.1"
},
{
"status": "affected",
"version": "x12.6.2"
},
{
"status": "affected",
"version": "x12.6.3"
},
{
"status": "affected",
"version": "x12.6.4"
},
{
"status": "affected",
"version": "x12.7.0"
},
{
"status": "affected",
"version": "x12.7.1"
},
{
"status": "affected",
"version": "x14.0.0"
},
{
"status": "affected",
"version": "x14.0.1"
},
{
"status": "affected",
"version": "x14.0.2"
},
{
"status": "affected",
"version": "x14.0.3"
},
{
"status": "affected",
"version": "x14.0.4"
},
{
"status": "affected",
"version": "x14.0.5"
},
{
"status": "affected",
"version": "x14.0.6"
},
{
"status": "affected",
"version": "x14.0.7"
},
{
"status": "affected",
"version": "x14.0.8"
},
{
"status": "affected",
"version": "x8.10.0"
},
{
"status": "affected",
"version": "x8.10.1"
},
{
"status": "affected",
"version": "x8.10.2"
},
{
"status": "affected",
"version": "x8.10.3"
},
{
"status": "affected",
"version": "x8.10.4"
},
{
"status": "affected",
"version": "x8.1.1"
},
{
"status": "affected",
"version": "x8.11.0"
},
{
"status": "affected",
"version": "x8.11.1"
},
{
"status": "affected",
"version": "x8.11.2"
},
{
"status": "affected",
"version": "x8.11.3"
},
{
"status": "affected",
"version": "x8.11.4"
},
{
"status": "affected",
"version": "x8.2"
},
{
"status": "affected",
"version": "x8.2.2"
},
{
"status": "affected",
"version": "x8.5"
},
{
"status": "affected",
"version": "x8.5.1"
},
{
"status": "affected",
"version": "x8.5.3"
},
{
"status": "affected",
"version": "x8.6"
},
{
"status": "affected",
"version": "x8.6.1"
},
{
"status": "affected",
"version": "x8.7"
},
{
"status": "affected",
"version": "x8.7.1"
},
{
"status": "affected",
"version": "x8.7.2"
},
{
"status": "affected",
"version": "x8.7.3"
},
{
"status": "affected",
"version": "x8.8"
},
{
"status": "affected",
"version": "x8.8.1"
},
{
"status": "affected",
"version": "x8.8.2"
},
{
"status": "affected",
"version": "x8.8.3"
},
{
"status": "affected",
"version": "x8.9"
},
{
"status": "affected",
"version": "x8.9.1"
},
{
"status": "affected",
"version": "x8.9.2"
},
{
"status": "affected",
"version": "x8.1"
},
{
"status": "affected",
"version": "x8.1.2"
},
{
"status": "affected",
"version": "x8.2.1"
},
{
"status": "affected",
"version": "x8.5.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-15T16:23:20.814823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T16:49:00.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the REST API of Cisco\u0026nbsp;Expressway Series and Cisco\u0026nbsp;TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r\nThis vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.\r\nCisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\u0026nbsp;"
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco\u00a0PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T15:27:23.911Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-sqpsSfY6",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eAttention\u003c/strong\u003e: Simplifying the Cisco\u0026nbsp;portfolio includes the renaming of security products under one brand: Cisco\u0026nbsp;Secure. For more information, see \u003ca href=\"https://www.cisco.com/c/en/us/products/security/secure-names.html\"\u003eMeet Cisco\u0026nbsp;Secure",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8"
}
],
"source": {
"advisory": "cisco-sa-expressway-csrf-sqpsSfY6",
"defects": [
"CSCwa25097"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence VCS Cross-Site Request Forgery Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20853",
"datePublished": "2024-11-15T15:27:23.911Z",
"dateReserved": "2021-11-02T13:28:29.180Z",
"dateUpdated": "2024-11-15T16:49:00.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20492 (GCVE-0-2024-20492)
Vulnerability from cvelistv5
Published
2024-10-02 16:55
Modified
2024-10-02 19:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Summary
A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentials with read-write privileges on an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a series of crafted CLI commands. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device.
Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 Version: X14.3.6 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:telepresence_video_communication_server:-:*:*:*:expressway:*:*:*"
],
"defaultStatus": "unknown",
"product": "telepresence_video_communication_server",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T18:57:14.215790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T19:24:15.214Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
},
{
"status": "affected",
"version": "X14.3.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentials with read-write privileges on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a series of crafted CLI commands. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T16:55:33.932Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expw-escalation-3bkz77bD",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expw-escalation-3bkz77bD"
}
],
"source": {
"advisory": "cisco-sa-expw-escalation-3bkz77bD",
"defects": [
"CSCwk75586"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Expressway Series Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20492",
"datePublished": "2024-10-02T16:55:33.932Z",
"dateReserved": "2023-11-08T15:08:07.685Z",
"dateUpdated": "2024-10-02T19:24:15.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20497 (GCVE-0-2024-20497)
Vulnerability from cvelistv5
Published
2024-09-04 16:29
Modified
2024-09-04 17:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-285 - Improper Authorization
Summary
A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system.
This vulnerability is due to inadequate authorization checks for Mobile and Remote Access (MRA) users. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to intercept calls that are destined for a particular phone number or to make phone calls and have that phone number appear on the caller ID. To successfully exploit this vulnerability, the attacker must be an MRA user on an affected system.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.11.2 Version: X8.6 Version: X8.11.3 Version: X8.2.2 Version: X8.8.3 Version: X8.11.0 Version: X12.5.2 Version: X8.1.1 Version: X8.9 Version: X12.5.1 Version: X12.5.6 Version: X8.7.3 Version: X12.6.0 Version: X8.11.1 Version: X8.5 Version: X8.9.1 Version: X8.10.2 Version: X8.8.2 Version: X8.5.3 Version: X8.1 Version: X8.9.2 Version: X8.11.4 Version: X12.5.4 Version: X8.8.1 Version: X8.2.1 Version: X8.5.1 Version: X8.6.1 Version: X8.1.2 Version: X8.8 Version: X8.10.0 Version: X12.5.3 Version: X8.10.1 Version: X12.5.7 Version: X8.10.3 Version: X8.7.1 Version: X8.2 Version: X12.5.8 Version: X8.7 Version: X8.5.2 Version: X12.5.9 Version: X12.5.0 Version: X8.10.4 Version: X8.7.2 Version: X12.5.5 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X14.0.0 Version: X14.0.1 Version: X14.0.2 Version: X14.0.3 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.2.0 Version: X14.0.9 Version: X14.2.1 Version: X14.2.2 Version: X14.0.11 Version: X14.2.5 Version: X14.0.10 Version: X14.2.6 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X15.0.0 Version: X14.3.4 Version: X14.3.5 Version: X15.0.1 Version: X15.0.2 Version: X15.0.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T17:33:31.143271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T17:33:38.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.5.2"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X14.0.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.1"
},
{
"status": "affected",
"version": "X15.0.2"
},
{
"status": "affected",
"version": "X15.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system.\r\n\r\nThis vulnerability is due to inadequate authorization checks for Mobile and Remote Access (MRA) users. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to intercept calls that are destined for a particular phone number or to make phone calls and have that phone number appear on the caller ID. To successfully exploit this vulnerability, the attacker must be an MRA user on an affected system."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T16:29:13.595Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-auth-kdFrcZ2j",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-auth-kdFrcZ2j"
}
],
"source": {
"advisory": "cisco-sa-expressway-auth-kdFrcZ2j",
"defects": [
"CSCwa25058"
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Edge Improper Authorization Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20497",
"datePublished": "2024-09-04T16:29:13.595Z",
"dateReserved": "2023-11-08T15:08:07.686Z",
"dateUpdated": "2024-09-04T17:33:38.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20400 (GCVE-0-2024-20400)
Vulnerability from cvelistv5
Published
2024-07-17 16:29
Modified
2024-08-01 21:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Summary
A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.
This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page.
Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.5.1 Version: X8.5.3 Version: X8.5 Version: X8.6.1 Version: X8.6 Version: X8.1.1 Version: X8.1.2 Version: X8.1 Version: X8.2.1 Version: X8.2.2 Version: X8.2 Version: X8.7.1 Version: X8.7.2 Version: X8.7.3 Version: X8.7 Version: X8.8.1 Version: X8.8.2 Version: X8.8.3 Version: X8.8 Version: X8.9.1 Version: X8.9.2 Version: X8.9 Version: X8.10.0 Version: X8.10.1 Version: X8.10.2 Version: X8.10.3 Version: X8.10.4 Version: X12.5.8 Version: X12.5.9 Version: X12.5.0 Version: X12.5.2 Version: X12.5.7 Version: X12.5.3 Version: X12.5.4 Version: X12.5.5 Version: X12.5.1 Version: X12.5.6 Version: X12.6.0 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X8.11.1 Version: X8.11.2 Version: X8.11.4 Version: X8.11.3 Version: X8.11.0 Version: X14.0.1 Version: X14.0.3 Version: X14.0.2 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 Version: X14.0.10 Version: X14.0.11 Version: X14.2.1 Version: X14.2.2 Version: X14.2.5 Version: X14.2.6 Version: X14.2.0 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 Version: X14.3.3 Version: X14.3.4 Version: X14.3.5 Version: X15.0.0 Version: X15.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-17T16:51:59.501192Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-17T16:52:12.586Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:59:41.611Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-expressway-redirect-KJsFuXgj",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-redirect-KJsFuXgj"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
},
{
"status": "affected",
"version": "X14.3.3"
},
{
"status": "affected",
"version": "X14.3.4"
},
{
"status": "affected",
"version": "X14.3.5"
},
{
"status": "affected",
"version": "X15.0.0"
},
{
"status": "affected",
"version": "X15.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.\r\n\r This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page.\r\n\r Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-17T16:29:36.302Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-redirect-KJsFuXgj",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-redirect-KJsFuXgj"
}
],
"source": {
"advisory": "cisco-sa-expressway-redirect-KJsFuXgj",
"defects": [
"CSCwa25104"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20400",
"datePublished": "2024-07-17T16:29:36.302Z",
"dateReserved": "2023-11-08T15:08:07.660Z",
"dateUpdated": "2024-08-01T21:59:41.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20255 (GCVE-0-2024-20255)
Vulnerability from cvelistv5
Published
2024-02-07 16:15
Modified
2025-05-08 18:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.5.1 Version: X8.5.3 Version: X8.5 Version: X8.6.1 Version: X8.6 Version: X8.1.1 Version: X8.1.2 Version: X8.1 Version: X8.2.1 Version: X8.2.2 Version: X8.2 Version: X8.7.1 Version: X8.7.2 Version: X8.7.3 Version: X8.7 Version: X8.8.1 Version: X8.8.2 Version: X8.8.3 Version: X8.8 Version: X8.9.1 Version: X8.9.2 Version: X8.9 Version: X8.10.0 Version: X8.10.1 Version: X8.10.2 Version: X8.10.3 Version: X8.10.4 Version: X12.5.8 Version: X12.5.9 Version: X12.5.0 Version: X12.5.2 Version: X12.5.7 Version: X12.5.3 Version: X12.5.4 Version: X12.5.5 Version: X12.5.1 Version: X12.5.6 Version: X12.6.0 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X8.11.1 Version: X8.11.2 Version: X8.11.4 Version: X8.11.3 Version: X8.11.0 Version: X14.0.1 Version: X14.0.3 Version: X14.0.2 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 Version: X14.0.10 Version: X14.0.11 Version: X14.2.1 Version: X14.2.2 Version: X14.2.5 Version: X14.2.6 Version: X14.2.0 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:52:31.599Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-KnnZDMj3",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T18:47:50.201453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-08T18:48:03.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-07T16:15:36.068Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-KnnZDMj3",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
}
],
"source": {
"advisory": "cisco-sa-expressway-csrf-KnnZDMj3",
"defects": [
"CSCwa25074"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20255",
"datePublished": "2024-02-07T16:15:36.068Z",
"dateReserved": "2023-11-08T15:08:07.622Z",
"dateUpdated": "2025-05-08T18:48:03.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20254 (GCVE-0-2024-20254)
Vulnerability from cvelistv5
Published
2024-02-07 16:15
Modified
2024-08-22 18:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device.
Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.5.1 Version: X8.5.3 Version: X8.5 Version: X8.6.1 Version: X8.6 Version: X8.1.1 Version: X8.1.2 Version: X8.1 Version: X8.2.1 Version: X8.2.2 Version: X8.2 Version: X8.7.1 Version: X8.7.2 Version: X8.7.3 Version: X8.7 Version: X8.8.1 Version: X8.8.2 Version: X8.8.3 Version: X8.8 Version: X8.9.1 Version: X8.9.2 Version: X8.9 Version: X8.10.0 Version: X8.10.1 Version: X8.10.2 Version: X8.10.3 Version: X8.10.4 Version: X12.5.8 Version: X12.5.9 Version: X12.5.0 Version: X12.5.2 Version: X12.5.7 Version: X12.5.3 Version: X12.5.4 Version: X12.5.5 Version: X12.5.1 Version: X12.5.6 Version: X12.6.0 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X8.11.1 Version: X8.11.2 Version: X8.11.4 Version: X8.11.3 Version: X8.11.0 Version: X14.0.1 Version: X14.0.3 Version: X14.0.2 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 Version: X14.0.10 Version: X14.0.11 Version: X14.2.1 Version: X14.2.2 Version: X14.2.5 Version: X14.2.6 Version: X14.2.0 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:52:38.971Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-KnnZDMj3",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:cisco_tele_presence_video_communication_serve\\/vcs\\/_expressway:x8.5.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cisco_tele_presence_video_communication_serve\\/vcs\\/_expressway",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "x8.5.1"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-08T05:00:11.095438Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T18:53:32.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. \r\n\r Note: \"Cisco Expressway Series\" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.\r\n\r For more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-07T16:15:25.666Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-KnnZDMj3",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
}
],
"source": {
"advisory": "cisco-sa-expressway-csrf-KnnZDMj3",
"defects": [
"CSCwa25100"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20254",
"datePublished": "2024-02-07T16:15:25.666Z",
"dateReserved": "2023-11-08T15:08:07.622Z",
"dateUpdated": "2024-08-22T18:53:32.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-20252 (GCVE-0-2024-20252)
Vulnerability from cvelistv5
Published
2024-02-07 16:15
Modified
2024-08-01 21:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device.
Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.5.1 Version: X8.5.3 Version: X8.5 Version: X8.6.1 Version: X8.6 Version: X8.1.1 Version: X8.1.2 Version: X8.1 Version: X8.2.1 Version: X8.2.2 Version: X8.2 Version: X8.7.1 Version: X8.7.2 Version: X8.7.3 Version: X8.7 Version: X8.8.1 Version: X8.8.2 Version: X8.8.3 Version: X8.8 Version: X8.9.1 Version: X8.9.2 Version: X8.9 Version: X8.10.0 Version: X8.10.1 Version: X8.10.2 Version: X8.10.3 Version: X8.10.4 Version: X12.5.8 Version: X12.5.9 Version: X12.5.0 Version: X12.5.2 Version: X12.5.7 Version: X12.5.3 Version: X12.5.4 Version: X12.5.5 Version: X12.5.1 Version: X12.5.6 Version: X12.6.0 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X8.11.1 Version: X8.11.2 Version: X8.11.4 Version: X8.11.3 Version: X8.11.0 Version: X14.0.1 Version: X14.0.3 Version: X14.0.2 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 Version: X14.0.10 Version: X14.0.11 Version: X14.2.1 Version: X14.2.2 Version: X14.2.5 Version: X14.2.6 Version: X14.2.0 Version: X14.2.7 Version: X14.3.0 Version: X14.3.1 Version: X14.3.2 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.5.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.5.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.5:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.6.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.6:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.1.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.1.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.2.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.2.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.7.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.7.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.7.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.7:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.8.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.8.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.8.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.8:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.9.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.9.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.9:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.10.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.10.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.10.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.10.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.10.4:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.8:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.9:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.7:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.4:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.5:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.5.6:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.6.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.6.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.6.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.6.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.6.4:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.7.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x12.7.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.11.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.11.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.11.4:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.11.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.11.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.3:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.4:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.5:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.6:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.7:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.8:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.9:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.10:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.0.11:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.2.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.2.2:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.2.5:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.2.6:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.2.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.2.7:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.3.0:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.3.1:*:*:*:expressway:*:*:*",
"cpe:2.3:a:cisco:telepresence_video_communication_server_software:x14.3.2:*:*:*:expressway:*:*:*"
],
"defaultStatus": "unknown",
"product": "telepresence_video_communication_server_software",
"vendor": "cisco",
"versions": [
{
"status": "affected",
"version": "x8.5.1"
},
{
"status": "affected",
"version": "x8.5.3"
},
{
"status": "affected",
"version": "x8.5"
},
{
"status": "affected",
"version": "x8.6.1"
},
{
"status": "affected",
"version": "x8.6"
},
{
"status": "affected",
"version": "x8.1.1"
},
{
"status": "affected",
"version": "x8.1.2"
},
{
"status": "affected",
"version": "x8.1"
},
{
"status": "affected",
"version": "x8.2.1"
},
{
"status": "affected",
"version": "x8.2.2"
},
{
"status": "affected",
"version": "x8.2"
},
{
"status": "affected",
"version": "x8.7.1"
},
{
"status": "affected",
"version": "x8.7.2"
},
{
"status": "affected",
"version": "x8.7.3"
},
{
"status": "affected",
"version": "x8.7"
},
{
"status": "affected",
"version": "x8.8.1"
},
{
"status": "affected",
"version": "x8.8.2"
},
{
"status": "affected",
"version": "x8.8.3"
},
{
"status": "affected",
"version": "x8.8"
},
{
"status": "affected",
"version": "x8.9.1"
},
{
"status": "affected",
"version": "x8.9.2"
},
{
"status": "affected",
"version": "x8.9"
},
{
"status": "affected",
"version": "x8.10.0"
},
{
"status": "affected",
"version": "x8.10.1"
},
{
"status": "affected",
"version": "x8.10.2"
},
{
"status": "affected",
"version": "x8.10.3"
},
{
"status": "affected",
"version": "x8.10.4"
},
{
"status": "affected",
"version": "x12.5.8"
},
{
"status": "affected",
"version": "x12.5.9"
},
{
"status": "affected",
"version": "x12.5.0"
},
{
"status": "affected",
"version": "x12.5.2"
},
{
"status": "affected",
"version": "x12.5.7"
},
{
"status": "affected",
"version": "x12.5.3"
},
{
"status": "affected",
"version": "x12.5.4"
},
{
"status": "affected",
"version": "x12.5.5"
},
{
"status": "affected",
"version": "x12.5.1"
},
{
"status": "affected",
"version": "x12.5.6"
},
{
"status": "affected",
"version": "x12.6.0"
},
{
"status": "affected",
"version": "x12.6.1"
},
{
"status": "affected",
"version": "x12.6.2"
},
{
"status": "affected",
"version": "x12.6.3"
},
{
"status": "affected",
"version": "x12.6.4"
},
{
"status": "affected",
"version": "x12.7.0"
},
{
"status": "affected",
"version": "x12.7.1"
},
{
"status": "affected",
"version": "x8.11.1"
},
{
"status": "affected",
"version": "x8.11.2"
},
{
"status": "affected",
"version": "x8.11.4"
},
{
"status": "affected",
"version": "x8.11.3"
},
{
"status": "affected",
"version": "x8.11.0"
},
{
"status": "affected",
"version": "x14.0.1"
},
{
"status": "affected",
"version": "x14.0.3"
},
{
"status": "affected",
"version": "x14.0.2"
},
{
"status": "affected",
"version": "x14.0.4"
},
{
"status": "affected",
"version": "x14.0.5"
},
{
"status": "affected",
"version": "x14.0.6"
},
{
"status": "affected",
"version": "x14.0.7"
},
{
"status": "affected",
"version": "x14.0.8"
},
{
"status": "affected",
"version": "x14.0.9"
},
{
"status": "affected",
"version": "x14.0.10"
},
{
"status": "affected",
"version": "x14.0.11"
},
{
"status": "affected",
"version": "x14.2.1"
},
{
"status": "affected",
"version": "x14.2.2"
},
{
"status": "affected",
"version": "x14.2.5"
},
{
"status": "affected",
"version": "x14.2.6"
},
{
"status": "affected",
"version": "x14.2.0"
},
{
"status": "affected",
"version": "x14.2.7"
},
{
"status": "affected",
"version": "x14.3.0"
},
{
"status": "affected",
"version": "x14.3.1"
},
{
"status": "affected",
"version": "x14.3.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20252",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-08T05:00:09.985386Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-29T20:37:52.838Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:52:31.791Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-KnnZDMj3",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
},
{
"status": "affected",
"version": "X14.3.1"
},
{
"status": "affected",
"version": "X14.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. \r\n\r Note: \"Cisco Expressway Series\" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.\r\n\r For more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-07T16:15:06.066Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-csrf-KnnZDMj3",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
}
],
"source": {
"advisory": "cisco-sa-expressway-csrf-KnnZDMj3",
"defects": [
"CSCwa25099"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20252",
"datePublished": "2024-02-07T16:15:06.066Z",
"dateReserved": "2023-11-08T15:08:07.622Z",
"dateUpdated": "2024-08-01T21:52:31.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-20209 (GCVE-0-2023-20209)
Vulnerability from cvelistv5
Published
2023-08-16 20:59
Modified
2025-12-16 18:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.5.1 Version: X8.5.3 Version: X8.5 Version: X8.6.1 Version: X8.6 Version: X8.1.1 Version: X8.1.2 Version: X8.1 Version: X8.2.1 Version: X8.2.2 Version: X8.2 Version: X8.7.1 Version: X8.7.2 Version: X8.7.3 Version: X8.7 Version: X8.8.1 Version: X8.8.2 Version: X8.8.3 Version: X8.8 Version: X8.9.1 Version: X8.9.2 Version: X8.9 Version: X8.10.0 Version: X8.10.1 Version: X8.10.2 Version: X8.10.3 Version: X8.10.4 Version: X12.5.8 Version: X12.5.9 Version: X12.5.0 Version: X12.5.2 Version: X12.5.7 Version: X12.5.3 Version: X12.5.4 Version: X12.5.5 Version: X12.5.1 Version: X12.5.6 Version: X12.6.0 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X8.11.1 Version: X8.11.2 Version: X8.11.4 Version: X8.11.3 Version: X8.11.0 Version: X14.0.1 Version: X14.0.3 Version: X14.0.2 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 Version: X14.0.10 Version: X14.0.11 Version: X14.2.1 Version: X14.2.2 Version: X14.2.5 Version: X14.2.6 Version: X14.2.0 Version: X14.2.7 Version: X14.3.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:35.876Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-expressway-injection-X475EbTQ",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-injection-X475EbTQ"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-20209",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-03T14:25:12.682012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T18:23:20.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.2"
},
{
"status": "affected",
"version": "X14.2.5"
},
{
"status": "affected",
"version": "X14.2.6"
},
{
"status": "affected",
"version": "X14.2.0"
},
{
"status": "affected",
"version": "X14.2.7"
},
{
"status": "affected",
"version": "X14.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device.\r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to establish a remote shell with root privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-25T16:58:00.269Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-injection-X475EbTQ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-injection-X475EbTQ"
}
],
"source": {
"advisory": "cisco-sa-expressway-injection-X475EbTQ",
"defects": [
"CSCwf57215"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20209",
"datePublished": "2023-08-16T20:59:41.848Z",
"dateReserved": "2022-10-27T18:47:50.367Z",
"dateUpdated": "2025-12-16T18:23:20.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-20192 (GCVE-0-2023-20192)
Vulnerability from cvelistv5
Published
2023-06-28 00:00
Modified
2024-08-02 09:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:36.844Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20230607 Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2023-06-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system. Note: \"Cisco Expressway Series\" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-28T00:00:00.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20230607 Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities",
"tags": [
"vendor-advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b"
}
],
"source": {
"advisory": "cisco-sa-expressway-priv-esc-Ls2B9t7b",
"defect": [
[
"CSCvz54058",
"CSCwf28030"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20192",
"datePublished": "2023-06-28T00:00:00.000Z",
"dateReserved": "2022-10-27T00:00:00.000Z",
"dateUpdated": "2024-08-02T09:05:36.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-20105 (GCVE-0-2023-20105)
Vulnerability from cvelistv5
Published
2023-06-28 00:00
Modified
2024-08-02 08:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affected system.
This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by authenticating to the application as a Read-only user and sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to alter the passwords of any user on the system, including an administrative user, and then impersonate that user.
Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: X8.5.1 Version: X8.5.3 Version: X8.5 Version: X8.6.1 Version: X8.6 Version: X8.1.1 Version: X8.1.2 Version: X8.1 Version: X8.2.1 Version: X8.2.2 Version: X8.2 Version: X8.7.1 Version: X8.7.2 Version: X8.7.3 Version: X8.7 Version: X8.8.1 Version: X8.8.2 Version: X8.8.3 Version: X8.8 Version: X8.9.1 Version: X8.9.2 Version: X8.9 Version: X8.10.0 Version: X8.10.1 Version: X8.10.2 Version: X8.10.3 Version: X8.10.4 Version: X12.5.8 Version: X12.5.9 Version: X12.5.0 Version: X12.5.2 Version: X12.5.7 Version: X12.5.3 Version: X12.5.4 Version: X12.5.5 Version: X12.5.1 Version: X12.5.6 Version: X12.6.0 Version: X12.6.1 Version: X12.6.2 Version: X12.6.3 Version: X12.6.4 Version: X12.7.0 Version: X12.7.1 Version: X8.11.1 Version: X8.11.2 Version: X8.11.4 Version: X8.11.3 Version: X8.11.0 Version: X14.0.1 Version: X14.0.3 Version: X14.0.2 Version: X14.0.4 Version: X14.0.5 Version: X14.0.6 Version: X14.0.7 Version: X14.0.8 Version: X14.0.9 Version: X14.0.10 Version: X14.0.11 Version: X14.2.1 Version: X14.2.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:57:35.717Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-expressway-priv-esc-Ls2B9t7b",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "X8.5.1"
},
{
"status": "affected",
"version": "X8.5.3"
},
{
"status": "affected",
"version": "X8.5"
},
{
"status": "affected",
"version": "X8.6.1"
},
{
"status": "affected",
"version": "X8.6"
},
{
"status": "affected",
"version": "X8.1.1"
},
{
"status": "affected",
"version": "X8.1.2"
},
{
"status": "affected",
"version": "X8.1"
},
{
"status": "affected",
"version": "X8.2.1"
},
{
"status": "affected",
"version": "X8.2.2"
},
{
"status": "affected",
"version": "X8.2"
},
{
"status": "affected",
"version": "X8.7.1"
},
{
"status": "affected",
"version": "X8.7.2"
},
{
"status": "affected",
"version": "X8.7.3"
},
{
"status": "affected",
"version": "X8.7"
},
{
"status": "affected",
"version": "X8.8.1"
},
{
"status": "affected",
"version": "X8.8.2"
},
{
"status": "affected",
"version": "X8.8.3"
},
{
"status": "affected",
"version": "X8.8"
},
{
"status": "affected",
"version": "X8.9.1"
},
{
"status": "affected",
"version": "X8.9.2"
},
{
"status": "affected",
"version": "X8.9"
},
{
"status": "affected",
"version": "X8.10.0"
},
{
"status": "affected",
"version": "X8.10.1"
},
{
"status": "affected",
"version": "X8.10.2"
},
{
"status": "affected",
"version": "X8.10.3"
},
{
"status": "affected",
"version": "X8.10.4"
},
{
"status": "affected",
"version": "X12.5.8"
},
{
"status": "affected",
"version": "X12.5.9"
},
{
"status": "affected",
"version": "X12.5.0"
},
{
"status": "affected",
"version": "X12.5.2"
},
{
"status": "affected",
"version": "X12.5.7"
},
{
"status": "affected",
"version": "X12.5.3"
},
{
"status": "affected",
"version": "X12.5.4"
},
{
"status": "affected",
"version": "X12.5.5"
},
{
"status": "affected",
"version": "X12.5.1"
},
{
"status": "affected",
"version": "X12.5.6"
},
{
"status": "affected",
"version": "X12.6.0"
},
{
"status": "affected",
"version": "X12.6.1"
},
{
"status": "affected",
"version": "X12.6.2"
},
{
"status": "affected",
"version": "X12.6.3"
},
{
"status": "affected",
"version": "X12.6.4"
},
{
"status": "affected",
"version": "X12.7.0"
},
{
"status": "affected",
"version": "X12.7.1"
},
{
"status": "affected",
"version": "X8.11.1"
},
{
"status": "affected",
"version": "X8.11.2"
},
{
"status": "affected",
"version": "X8.11.4"
},
{
"status": "affected",
"version": "X8.11.3"
},
{
"status": "affected",
"version": "X8.11.0"
},
{
"status": "affected",
"version": "X14.0.1"
},
{
"status": "affected",
"version": "X14.0.3"
},
{
"status": "affected",
"version": "X14.0.2"
},
{
"status": "affected",
"version": "X14.0.4"
},
{
"status": "affected",
"version": "X14.0.5"
},
{
"status": "affected",
"version": "X14.0.6"
},
{
"status": "affected",
"version": "X14.0.7"
},
{
"status": "affected",
"version": "X14.0.8"
},
{
"status": "affected",
"version": "X14.0.9"
},
{
"status": "affected",
"version": "X14.0.10"
},
{
"status": "affected",
"version": "X14.0.11"
},
{
"status": "affected",
"version": "X14.2.1"
},
{
"status": "affected",
"version": "X14.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affected system.\r\n\r This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by authenticating to the application as a Read-only user and sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to alter the passwords of any user on the system, including an administrative user, and then impersonate that user.\r\n\r Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-25T16:57:44.401Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-expressway-priv-esc-Ls2B9t7b",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b"
}
],
"source": {
"advisory": "cisco-sa-expressway-priv-esc-Ls2B9t7b",
"defects": [
"CSCvz54058"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20105",
"datePublished": "2023-06-28T00:00:00.000Z",
"dateReserved": "2022-10-27T00:00:00.000Z",
"dateUpdated": "2024-08-02T08:57:35.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20813 (GCVE-0-2022-20813)
Vulnerability from cvelistv5
Published
2022-07-06 20:30
Modified
2024-11-06 16:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.984Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220706 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T16:00:04.733976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:11:39.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-06T20:30:45.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220706 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH"
}
],
"source": {
"advisory": "cisco-sa-expressway-overwrite-3buqW8LH",
"defect": [
[
"CSCwa01080",
"CSCwa01085"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-07-06T16:00:00",
"ID": "CVE-2022-20813",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.0",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-158"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220706 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH"
}
]
},
"source": {
"advisory": "cisco-sa-expressway-overwrite-3buqW8LH",
"defect": [
[
"CSCwa01080",
"CSCwa01085"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20813",
"datePublished": "2022-07-06T20:30:45.861Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:11:39.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20812 (GCVE-0-2022-20812)
Vulnerability from cvelistv5
Published
2022-07-06 20:30
Modified
2024-11-06 16:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.909Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220706 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH"
},
{
"name": "20221005 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T16:00:05.599729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:11:48.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-06T00:00:00.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220706 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH"
},
{
"name": "20221005 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6"
}
],
"source": {
"advisory": "cisco-sa-expressway-overwrite-3buqW8LH",
"defect": [
[
"CSCwa01080",
"CSCwa01085"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20812",
"datePublished": "2022-07-06T20:30:40.411Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:11:48.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20807 (GCVE-0-2022-20807)
Vulnerability from cvelistv5
Published
2022-05-27 14:07
Modified
2024-11-06 16:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.939Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20807",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T15:58:08.230526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:12:45.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-27T14:07:13.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
],
"source": {
"advisory": "cisco-sa-expressway-filewrite-bsFVwueV",
"defect": [
[
"CSCvz71486",
"CSCwa25061",
"CSCwa25106"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-05-18T16:00:00",
"ID": "CVE-2022-20807",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-532"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
]
},
"source": {
"advisory": "cisco-sa-expressway-filewrite-bsFVwueV",
"defect": [
[
"CSCvz71486",
"CSCwa25061",
"CSCwa25106"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20807",
"datePublished": "2022-05-27T14:07:13.221Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:12:45.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20806 (GCVE-0-2022-20806)
Vulnerability from cvelistv5
Published
2022-05-27 14:06
Modified
2024-11-06 16:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.710Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T15:58:09.782986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:12:55.335Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-27T14:06:53.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
],
"source": {
"advisory": "cisco-sa-expressway-filewrite-bsFVwueV",
"defect": [
[
"CSCvz71486",
"CSCwa25061",
"CSCwa25106"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-05-18T16:00:00",
"ID": "CVE-2022-20806",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-532"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
]
},
"source": {
"advisory": "cisco-sa-expressway-filewrite-bsFVwueV",
"defect": [
[
"CSCvz71486",
"CSCwa25061",
"CSCwa25106"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20806",
"datePublished": "2022-05-27T14:06:53.551Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:12:55.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20809 (GCVE-0-2022-20809)
Vulnerability from cvelistv5
Published
2022-05-26 14:00
Modified
2024-11-06 16:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T15:58:23.470658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:15:15.407Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-26T14:00:20.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
],
"source": {
"advisory": "cisco-sa-expressway-filewrite-bsFVwueV",
"defect": [
[
"CSCvz71486",
"CSCwa25061",
"CSCwa25106"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-05-18T16:00:00",
"ID": "CVE-2022-20809",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-532"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220518 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-bsFVwueV"
}
]
},
"source": {
"advisory": "cisco-sa-expressway-filewrite-bsFVwueV",
"defect": [
[
"CSCvz71486",
"CSCwa25061",
"CSCwa25106"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20809",
"datePublished": "2022-05-26T14:00:21.044Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:15:15.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20755 (GCVE-0-2022-20755)
Vulnerability from cvelistv5
Published
2022-04-06 18:13
Modified
2024-11-06 16:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.405Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220303 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T16:00:16.905021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:28:01.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-03-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-06T18:13:45.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220303 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk"
}
],
"source": {
"advisory": "cisco-sa-expressway-filewrite-87Q5YRk",
"defect": [
[
"CSCvz85393",
"CSCwa25107"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-03-03T00:00:00",
"ID": "CVE-2022-20755",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.0",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-23"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220303 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk"
}
]
},
"source": {
"advisory": "cisco-sa-expressway-filewrite-87Q5YRk",
"defect": [
[
"CSCvz85393",
"CSCwa25107"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20755",
"datePublished": "2022-04-06T18:13:45.789Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:28:01.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-20754 (GCVE-0-2022-20754)
Vulnerability from cvelistv5
Published
2022-04-06 18:13
Modified
2024-11-06 16:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.472Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220303 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T16:00:17.741188Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:28:10.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-03-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-06T18:13:44.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220303 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk"
}
],
"source": {
"advisory": "cisco-sa-expressway-filewrite-87Q5YRk",
"defect": [
[
"CSCvz85393",
"CSCwa25107"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-03-03T00:00:00",
"ID": "CVE-2022-20754",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "9.0",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-23"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220303 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk"
}
]
},
"source": {
"advisory": "cisco-sa-expressway-filewrite-87Q5YRk",
"defect": [
[
"CSCvz85393",
"CSCwa25107"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20754",
"datePublished": "2022-04-06T18:13:44.210Z",
"dateReserved": "2021-11-02T00:00:00.000Z",
"dateUpdated": "2024-11-06T16:28:10.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-34716 (GCVE-0-2021-34716)
Vulnerability from cvelistv5
Published
2021-08-18 19:40
Modified
2024-11-07 22:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then uploading specific crafted software images to the affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway |
Version: n/a |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:48.084Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20210818 Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewrce-QPynNCjh"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-34716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T21:43:27.670741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T22:04:01.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2021-08-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then uploading specific crafted software images to the affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-460",
"description": "CWE-460",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-18T19:40:21.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20210818 Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewrce-QPynNCjh"
}
],
"source": {
"advisory": "cisco-sa-ewrce-QPynNCjh",
"defect": [
[
"CSCvy96491"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2021-08-18T16:00:00",
"ID": "CVE-2021-34716",
"STATE": "PUBLIC",
"TITLE": "Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then uploading specific crafted software images to the affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "6.7",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-460"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20210818 Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewrce-QPynNCjh"
}
]
},
"source": {
"advisory": "cisco-sa-ewrce-QPynNCjh",
"defect": [
[
"CSCvy96491"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2021-34716",
"datePublished": "2021-08-18T19:40:21.953Z",
"dateReserved": "2021-06-15T00:00:00.000Z",
"dateUpdated": "2024-11-07T22:04:01.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}