Cisco TelePresence System MXP Series Software Denial of Service Vulnerability

A vulnerability in Cisco TelePresence System MXP Series Software could allow an unauthenticated, remote attacker to cause an affected system to become unresponsive to management session requests via Telnet.

The vulnerability is due to a memory leak when management flows are created. An attacker could exploit this vulnerability by creating several management session requests.

Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.

To exploit this vulnerability, an attacker must determine whether the Telnet service is running on a targeted device.

All MXP products have reached end of life (EOL) and end of software support (EoSW). Customer are advised to review the EOL/EoSW support notice at the following link: End-of-Sale and End-of-Life Announcement for the Cisco TelePresence System Edge 75/95 MXP[“http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/telepresence-system-edge-mxp-series/end_of_life_notice_c51-720894.html”]