Skip to main content

Telepresence Video Communication Server CVE-2017-12287

MEDIUM
Resource Management Errors (CWE-399)
2017-10-19 psirt@cisco.com
Denial Of Service Cisco Telepresence Video Communication Server Telepresence Conductor Expressway
4.3
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

1
CVE Published
Oct 19, 2017 - 08:29 cve.org
MEDIUM 4.3

DescriptionCVE.org

A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to cause the CDB process on an affected system to restart unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability is due to incomplete input validation of URL requests by the REST API of the affected software. An attacker could exploit this vulnerability by sending a crafted URL to the REST API of the affected software on an affected system. A successful exploit could allow the attacker to cause the CDB process on the affected system to restart unexpectedly, resulting in a temporary DoS condition. Cisco Bug IDs: CSCve77571.

AnalysisAI

A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-399. A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to cause the CDB process on an affected system to restart unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability is due to incomplete input validation of URL requests by the REST API of the affected software. An attacker could exploit this vulnerability by sending a crafted URL to the REST API of the affected software on an affected system. A successful exploit could allow the attacker to cause the CDB process on the affected system to restart unexpectedly, resulting in a temporary DoS condition. Cisco Bug IDs: CSCve77571. Affected products include: Cisco Expressway, Cisco Telepresence Conductor, Cisco Telepresence Video Communication Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Telepresence Video Communication Server

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2016-1468 HIGH
8.8 Aug 08

The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authen
CVE-2017-3790 HIGH
8.6 Feb 01

A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Serv
CVE-2019-1845 HIGH
8.6 Jun 05

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM
CVE-2012-0330 HIGH
7.8 Mar 01

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of s
CVE-2023-20192 HIGH
7.7 Jun 28

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow

CVE-2016-1400 HIGH
7.5 May 25

Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of ser
CVE-2012-0331 HIGH
7.5 Mar 01

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of s
CVE-2020-3596 HIGH
7.5 Oct 08

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communi
CVE-2018-0409 HIGH
7.5 Aug 15

A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P)

CVE-2018-0358 HIGH
7.5 Jun 21

A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could

CVE-2023-20209 HIGH
7.2 Aug 16

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communicat

Same weakness CWE-399 – Resource Management Errors

View all
CVE-2013-3893 HIGH POC
8.8
CVE-2013-0025 CRITICAL POC
9.3
CVE-2015-0064 CRITICAL POC
9.3
CVE-2015-0065 CRITICAL POC
9.3
CVE-2013-3846 CRITICAL POC
9.3
CVE-2016-5427 HIGH
7.5
CVE-2013-0233 MEDIUM POC
6.8
CVE-2013-1305 HIGH
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2017-12287 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy