CVE-2014-0675: Medium severity Cisco TelePresence Video Communication Server vulnerability
The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship, aka Bug ID CSCue07471.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Cisco TelePresence Video Communication Server (VCS) Expressway, mitigate the CSCue07471 man-in-the-middle risk by ensuring each customer installation uses a unique X.509 certificate instead of the shared default certificate (so attackers cannot leverage the default certificate’s trust relationship across deployments).
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0675?
CVE-2014-0675 has a CVSS base score that indicates it is a high-severity vulnerability.
How do I fix CVE-2014-0675?
To fix CVE-2014-0675, you should update your Cisco TelePresence Video Communication Server to the latest firmware version provided by Cisco.
What are the potential risks associated with CVE-2014-0675?
The potential risks of CVE-2014-0675 include exposure to man-in-the-middle attacks, which can lead to data interception or unauthorized access.
Which systems are impacted by CVE-2014-0675?
CVE-2014-0675 affects installations of Cisco TelePresence Video Communication Server that utilize default X.509 certificates.
Is CVE-2014-0675 a common vulnerability?
Yes, CVE-2014-0675 is considered common due to the use of default certificates across multiple customer installations.