CVE-2018-0262
First published: Wed May 02 2018(Updated: )
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain unauthorized access to components of, or sensitive information in, an affected system, leading to Remote Code Execution. The vulnerability is due to incorrect default configuration of the device, which can expose internal interfaces and ports on the external interface of the system. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files as well as sensitive meeting information on an affected system. Additionally, if the Traversal Using Relay NAT (TURN) service is enabled and utilizing Transport Layer Security (TLS) connections, an attacker could utilize TURN credentials to forward traffic to device daemons, allowing for remote exploitation. This vulnerability affects Cisco Meeting Server (CMS) Acano X-series platforms that are running a CMS Software release prior to 2.2.11. Cisco Bug IDs: CSCvg76469.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Meeting Server | =1.9 | |
| Cisco Meeting Server | =2.0 | |
| Cisco Meeting Server | =2.1 | |
| Cisco Meeting Server | =2.2 | |
| Cisco Meeting Server | =2.3 | |
| Cisco Meeting Server | =2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-0262?
CVE-2018-0262 is a vulnerability in Cisco Meeting Server that could allow an unauthenticated remote attacker to gain unauthorized access to components of, or sensitive information in, an affected system, leading to Remote Code Execution.
How severe is CVE-2018-0262?
CVE-2018-0262 has a severity rating of 8.1, which is considered high.
How can an attacker exploit CVE-2018-0262?
An attacker can exploit CVE-2018-0262 by leveraging an incorrect default configuration of the Cisco Meeting Server to gain unauthorized access and execute remote code.
Which versions of Cisco Meeting Server are affected by CVE-2018-0262?
Versions 1.9, 2.0, 2.1, 2.2, 2.3, and 2.4 of Cisco Meeting Server are affected by CVE-2018-0262.
How can I fix CVE-2018-0262?
To fix CVE-2018-0262, it is recommended to apply the necessary updates provided by Cisco. Please refer to Cisco's security advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/tags
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cisco
- canonical/cisco meeting server
- version/cisco meeting server/1.9
- version/cisco meeting server/2.0
- version/cisco meeting server/2.1
- version/cisco meeting server/2.2
- version/cisco meeting server/2.3
- version/cisco meeting server/2.4