Cisco Expressway Series vulnerabilities

2 CVEs affecting Cisco Expressway Series, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-1722, published 2019-04-18.

More from Cisco.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-5390, published 2018-08-06. High severity, CVSS 7.5. EPSS: 71.1% chance of exploitation in the next 30 days. Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.
• CVE-2019-1722, published 2019-04-18. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site…