Unscored severity · published May 26, 2014
CVE-2014-3274
Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, aka Bug ID CSCuj26326.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Telepresence System Software · Cisco
through 6.0.5\(5\); 1.2.3(1101); 1.3.2(1393); 1.4.7(2229); 1.5.1(2082); 1.5.3(2115); +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3274
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34327
Third Party Advisory
http://www.securitytracker.com/id/1030272
More from Telepresence System Software
–
CVE-2014-3362
Memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote attackers to cause a denial of service (management outage) via multiple TELNET…
–
CVE-2014-2161
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka…
–
CVE-2014-2160
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka…
–
CVE-2014-2159
The H.225 subsystem in Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted packets, aka…
–
CVE-2014-2158
Cisco TelePresence System MXP Series Software before F9.3.1 allows remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug ID CSCty45720