CVE-2014-7991

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager CM 10.01 and earlier does not properly validate the Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a...

Design/Logic Flaw

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager CM 10.01 and earlier does not properly validate the Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a...

CVE-2014-7991

The CVE-2014-7991 issue affects Cisco Unified Communications Manager (CM) Remote Mobile Access Subsystem for CM 10.0(1) and earlier. It stems from improper validation of the SAN field in TLS certificates, enabling a remote attacker to impersonate a VCS core device and perform MITM attacks when a ...

CVE-2014-7991

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager CM 10.01 and earlier does not properly validate the Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a...

Cisco TelePresence VCS / Expressway Series < 8.2 Multiple DoS Vulnerabilities

According to the self-reported version, returned by a standard SNMP request, the version of the Cisco TelePresence VCS or Expressway Series device prior to 8.2. It is, therefore, potentially affected by multiple denial of service vulnerabilities : - A flaw exists in packet processing when...

CVE-2014-3368

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.2 allow remote attackers to cause a denial of service device reload via a high rate of crafted packets, aka Bug ID CSCui06507...

CVE-2014-3370

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...

CVE-2014-3369

The SIP IX implementation in Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service device reload via crafted SDP packets, aka Bug ID CSCuo42252...

Code injection

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.2 allow remote attackers to cause a denial of service device reload via a high rate of crafted packets, aka Bug ID CSCui06507...

Code injection

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...

CVE-2014-3369

The SIP IX implementation in Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service device reload via crafted SDP packets, aka Bug ID CSCuo42252...

CVE-2014-3369

Cisco TelePresence Video Communication Server (VCS) and Expressway Software prior to X8.1.1 are affected by a DoS vulnerability in the SIP IX implementation triggered by specially crafted SDP packets, causing a device reload. The issue is tied to CSCuo42252 (SIP IX) and is addressed by Cisco in a...

CVE-2014-3370

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...

CVE-2014-3370

CVE-2014-3370 affects Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Software predating X8.1.1. A vulnerability in the SIP processing/module allows remote attackers to trigger a denial of service (device reload) via crafted SIP packets (Bug IDs CSCum60442, CSCum60447). D...

CVE-2014-3368

Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Software, versions prior to X8.2, are affected by CVE-2014-3368. A flaw in packet processing when handling a high rate of crafted IP packets can remotely cause a denial of service by triggering a device reload. Exploitation ...

CVE-2014-3368

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.2 allow remote attackers to cause a denial of service device reload via a high rate of crafted packets, aka Bug ID CSCui06507...

Phabricator: Abusing VCS control on phabricator

My reporting skills suck but I tried to make a clear report. Please let me know if you need any further clarifications...

Cisco TelePresence Video Communication Server Expressway Default SSL Certificate Vulnerability

A vulnerability in the Cisco TelePresence Video Communication Server VCS Expressway could allow an unauthenticated, remote attacker to execute a man-in-the-middle MITM attack between one or more affected devices. The vulnerability occurs because the same default SSL certificate is used across all...

CVE-2014-0675

The Expressway component in Cisco TelePresence Video Communication Server VCS uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's tru...

CVE-2014-0675

Cisco TelePresence Video Communication Server (VCS) Expressway is affected by CVE-2014-0675 due to using the same default X.509 SSL certificate across multiple customers, with the private key published. This enables potential MITM-style interception across SSL sessions if an attacker can leverage...