cisco-sa-Expressway-8J3yZ7hV: Cisco Expressway Software TURN Server Configuration Issue
First published: Wed Nov 18 2020(Updated: )
The Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software supports the relay of media connections through a firewall using proxy services. As a result of this feature, interfaces such as the Cisco Expressway web administrative interface may become accessible from external networks. At the time of publication, documentation of the feature did not properly explain that users are able to bypass firewall protections that are designed to restrict access to the Cisco Expressway web administrative interface. However, an attacker must have credentials sufficient to use TURN services to be able to send network requests to the web administrative interface. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-Expressway-8J3yZ7hV
Credit: Christian Mehlmauer WienCERT
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence VCS and Expressway Major |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-Expressway-8J3yZ7hV?
The severity of cisco-sa-Expressway-8J3yZ7hV is classified as high due to potential unauthorized access through media connection relaying.
How do I fix cisco-sa-Expressway-8J3yZ7hV?
To fix cisco-sa-Expressway-8J3yZ7hV, apply the latest security patches provided by Cisco for the affected Expressway software.
What are the implications of cisco-sa-Expressway-8J3yZ7hV?
The implications of cisco-sa-Expressway-8J3yZ7hV include the risk of unauthorized access and potential exposure of sensitive media connections.
Which versions of Cisco Expressway are affected by cisco-sa-Expressway-8J3yZ7hV?
cisco-sa-Expressway-8J3yZ7hV affects multiple versions of the Cisco Expressway software, particularly the Expressway-C component.
What components are impacted by cisco-sa-Expressway-8J3yZ7hV?
The impacted component in cisco-sa-Expressway-8J3yZ7hV is the Traversal Using Relays around NAT (TURN) server within the Cisco Expressway.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco telepresence vcs and expressway major