Cisco Connected Mobile Experiences vulnerabilities

8 CVEs affecting Cisco Connected Mobile Experiences, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44487, published 2023-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-1144, published 2021-01-13. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow a remote, authenticated attacker without administrative privileges to alter the password of any user on an affected system. The…
CVE-2021-1522, published 2021-08-04. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with…
CVE-2021-1143, published 2021-01-13. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on the system. The vulnerability is due to a…
CVE-2019-1645, published 2019-01-24. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the Cisco Connected Mobile Experiences (CMX) software could allow an unauthenticated, adjacent attacker to access sensitive data on an affected device. The vulnerability is due to…
CVE-2020-3152, published 2020-08-26. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary commands with root privileges. The…
CVE-2020-3151, published 2020-08-26. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to bypass restrictions on the CLI. The…