Cisco Telepresence Video Communication Server vulnerabilities

42 CVEs affecting Cisco Telepresence Video Communication Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-20853, published 2024-11-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-20209, published 2023-08-16. High severity, CVSS 7.2. EPSS: 40.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write…
CVE-2019-1845, published 2019-06-05. High severity, CVSS 8.6. EPSS: 4.6% chance of exploitation in the next 30 days. A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco…
CVE-2019-1854, published 2019-05-03. Medium severity, CVSS 4.3. EPSS: 3.7% chance of exploitation in the next 30 days. A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The…
CVE-2017-3790, published 2017-02-01. High severity, CVSS 8.6. EPSS: 3.5% chance of exploitation in the next 30 days. A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a…
CVE-2018-0409, published 2018-08-15. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS) and Expressway…
CVE-2022-20755, published 2022-04-06. High severity, CVSS 7.2. EPSS: 3.3% chance of exploitation in the next 30 days. Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote…
CVE-2022-20754, published 2022-04-06. High severity, CVSS 7.2. EPSS: 3.3% chance of exploitation in the next 30 days. Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote…
CVE-2016-1468, published 2016-08-08. High severity, CVSS 8.8. EPSS: 2.9% chance of exploitation in the next 30 days. The administrative web interface in Cisco TelePresence Video Communication Server Expressway X8.5.2 allows remote authenticated users to execute arbitrary commands via crafted fields, aka Bug ID…
CVE-2018-15430, published 2018-10-05. High severity, CVSS 7.2. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code…

Latest

CVE-2022-20853, published 2024-11-15. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack…
CVE-2022-20814, published 2024-11-15. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive…
CVE-2024-20492, published 2024-10-02. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate…
CVE-2024-20400, published 2024-07-17. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is…
CVE-2023-20192, published 2023-06-28. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to…
CVE-2023-20105, published 2023-06-28. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only…
CVE-2022-20813, published 2022-07-06. Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to…
CVE-2022-20812, published 2022-07-06. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to…