What is the CVSS score of CVE-2014-0691?

CVE-2014-0691 has a CVSS 3.0 base score of 7.3 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Webex Meetings Server CVE-2014-0691

HIGH

Insufficient Entropy (CWE-331)

2017-10-24 psirt@cisco.com

Authentication Bypass Cisco Webex Meetings Server

7.3

CVSS 3.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-331 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Entropy requirements
Impact	CVSS score of 7.3 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.16%.
Exploit ScenarioDerived	This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password,. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified under CWE-331. Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643. Affected products include: Cisco Webex Meetings Server. Version information: before 1.1.

Know when Webex Meetings Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

DescriptionCVE.org

Threat Intelligence Overview

EPSS Score

0.2%

Top 63% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*

More in Webex Meetings Server

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2017-6753 HIGH Act Now

8.8 Jul 25

A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated,

CVE-2017-12372 CRITICAL Act Now

9.6 Nov 30

A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Pla

CVE-2017-12368 CRITICAL Act Now

9.6 Nov 30

A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Pla

CVE-2017-12367 CRITICAL Act Now

9.6 Nov 30

A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player

CVE-2020-3361 CRITICAL Act Now

9.8 Jun 18

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker

CVE-2018-0104 CRITICAL Act Now

9.6 Jan 04

A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote a

CVE-2015-0589 CRITICAL Act Now

9.0 Feb 07

The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to exe

CVE-2020-3419 CRITICAL Act Now

9.1 Nov 18

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker

CVE-2018-0112 CRITICAL Act Now

9.0 Apr 19

A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow

CVE-2016-1446 HIGH This Week

8.8 Jul 15

SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQ

Same weakness CWE-331 – Insufficient Entropy

View all

CVE-2025-47781 CRITICAL POC

9.8

CVE-2025-67504 CRITICAL POC

9.8

CVE-2020-36925 CRITICAL POC

9.8

CVE-2023-49599 CRITICAL POC

9.8

CVE-2024-36400 CRITICAL POC

9.8

CVE-2022-34294 CRITICAL POC

9.8

CVE-2020-12735 CRITICAL POC

9.8

CVE-2026-71851 CRITICAL POC

9.0

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/1_1/b_Release_Notes.html

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back