EUVD-2026-107383
GHSA-667p-34p2-c6m9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Expressway-E
-
ExploitCraft unauthorized MRA provisioning URL
-
ExecutionSubmit HTTP request bypassing authorization checks
-
ImpactRetrieve sensitive device information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | Exploitation requires the affected device to have Mobile and Remote Access (MRA) provisioning reachable by the attacker - in practice an internet-facing Expressway-E deployed as the MRA edge, since the flaw is in authorization checks of HTTP requests during MRA provisioning. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and no non-default configuration is stated beyond MRA being in use. Limiting factors: devices not configured for/offering MRA provisioning, and Expressway-C deployed purely internally (not internet-reachable), substantially reduce realistic exposure; impact is confined to disclosure of sensitive information (no integrity or availability effect). |
| Impact | This is a medium-severity information-disclosure flaw (CVSS 5.3) whose signals are internally consistent but modest. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the most dangerous attacker-friendly conditions - network-reachable, low complexity, no privileges, no user interaction - which maps to an unauthenticated remote attacker. However, impact is deliberately narrow: only confidentiality is affected and only at Low (C:L/I:N/A:N), consistent with CWE-497 (exposure of sensitive system information) rather than code execution or full data compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent mass exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The practical risk is driven less by raw severity than by exposure: Expressway-E is an internet-facing edge appliance for Mobile and Remote Access, so affected devices are reachable from the internet by design, which raises the realistic attack surface above what a 5.3 score alone suggests. Net: treat as a routine-to-prioritized patch for internet-exposed Expressway-E, but not an emergency. One data caveat to verify: the CPE and one tag label the product as 'Cisco Telepresence Video Communication Server (VCS) Expressway,' while the description and note specify the current 'Cisco Expressway Series' (Expressway-C/Expressway-E) - related product lineage, but confirm exact affected versions against the Cisco advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker on the internet sends a crafted URL/HTTP request to an internet-facing Expressway-E device, abusing missing authorization checks in the MRA provisioning path. Because no credentials, user interaction, or special timing are required (AV:N/AC:L/PR:N/UI:N), the attacker retrieves sensitive information from the device that should have required authorization. No public POC was identified at time of analysis, so exploitation would require the attacker to independently reconstruct the vulnerable request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attacker read sensitive data from devices that use Mobile and Remote Access (MRA) provisioning, with a CVSS score of 5.3 and confidentiality-only impact. The root cause is insufficient authorization checks on HTTP requests handled during MRA provisioning, so a crafted URL can return information the requester is not authorized to see; no integrity or availability impact is assessed. No public exploit code or CISA KEV entry was identified at time of analysis, and realistic exposure is concentrated on internet-facing Expressway-E deployments that offer MRA.
RemediationAI
The provided data does not identify a specific fixed release or a confirmed vendor patch status, so the primary action is to consult Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS for the applicable software upgrade and install it on both Expressway-C and Expressway-E. If an immediate upgrade is not possible, reduce exposure by disabling MRA provisioning entirely when remote access is not required (this breaks Jabber/MRA client connectivity for remote users), or by restricting reachability of MRA provisioning endpoints on the Expressway-E to trusted source networks via firewall or ACL policy (this can disrupt roaming or unmanaged endpoints and requires ongoing maintenance of allowlists). Keep Expressway-E in the DMZ with only the minimum required services exposed, and review HTTP request logs for anomalous or crafted provisioning URLs as a detection measure, recognizing that such monitoring is detective rather than preventive.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an authorization weakness (CWE-497, exposure of sensitive system information to an unauthorized control sphere) in the HTTP request handling used for Mobile and Remote Access provisioning on Cisco Expressway Series, which comprises Expressway-C (inside the enterprise) and Expressway-E (the DMZ edge that terminates MRA traffic for Jabber and similar clients). During MRA provisioning these components exchange and serve configuration and service information over HTTPS; because authorization checks on those requests are insufficient, a crafted URL can reach data that should be restricted. The provided CPE string (cpe:2.3:a:cisco:cisco_telepresence_video_communication_server_(vcs)_expressway:*:*:*:*:*:*:*:*) identifies the affected product family but the input does not enumerate specific vulnerable or fixed releases. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation is network-reachable with no authentication and no user interaction, but in practice it requires MRA provisioning to be reachable by the attacker, typically an internet-facing Expressway-E; purely internal Expressway-C deployments or devices without MRA provisioning are substantially less exposed.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request against an internet-facing MRA endpoint gives AV:N/AC:L/PR:N/UI:N; impact is limited information disclosure, so C:L with I:N/A:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.
This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Exploit-DB