Vulnerability identifier: #VU13406
Vulnerability risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Cisco Meeting Server
Client/Desktop applications /
Multimedia software
Vendor: Cisco Systems, Inc
Description
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists in the Web Admin Interface of Cisco Meeting Server due to insufficient validation of incoming HTTP requests. A remote attacker can send a specially crafted HTTP request to the Web Admin Interface and cause the system to restart, terminating all ongoing calls.
Mitigation
The vulnerability is addressed in the versions 2.2.13, 2.3.4.
Vulnerable software versions
Cisco Meeting Server: 2.2.5
External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-meeting-serv...
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.