CVE-2020-3197: Cisco Meetings App Missing TURN Server Credentials Expiration Vulnerability
First published: Thu Jul 16 2020(Updated: )
A vulnerability in the API subsystem of Cisco Meetings App could allow an unauthenticated, remote attacker to retain and reuse the Traversal Using Relay NAT (TURN) server credentials that are configured in an affected system. The vulnerability is due to insufficient protection mechanisms for the TURN server credentials. An attacker could exploit this vulnerability by intercepting the legitimate traffic that is generated by an affected system. An exploit could allow the attacker to obtain the TURN server credentials, which the attacker could use to place audio/video calls and forward packets through the configured TURN server. The attacker would not be able to take control of the TURN server unless the same credentials were used in multiple systems.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Meeting Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-3197.
What is the severity of CVE-2020-3197?
The severity of CVE-2020-3197 is medium (5.3).
What software is affected by CVE-2020-3197?
The Cisco Meeting Server software is affected by CVE-2020-3197.
How does CVE-2020-3197 affect the Cisco Meetings App?
CVE-2020-3197 allows an unauthenticated, remote attacker to retain and reuse the Traversal Using Relay NAT (TURN) server credentials configured in the Cisco Meetings App.
Is there a fix available for CVE-2020-3197?
Yes, Cisco has released a security advisory with mitigation details for CVE-2020-3197. Please refer to the advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/description
- agent/tags
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/cisco
- canonical/cisco meeting server