// For flags

CVE-2020-3482

Cisco Expressway Software Unauthorized Access Information Disclosure Vulnerability

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific connection information by the TURN server within the affected software. An attacker could exploit this issue by sending specially crafted network traffic to the affected software. A successful exploit could allow the attacker to send traffic through the affected software to destinations beyond the application, possibly allowing the attacker to gain unauthorized network access.

Una vulnerabilidad en el componente servidor Traversal Using Relays around NAT (TURN) del software Cisco Expressway, podría permitir a un atacante remoto no autenticado omitir los controles de seguridad y enviar tráfico de red hacia destinos restringidos. La vulnerabilidad es debido a una comprobación inapropiada de la información de conexión específica por parte del servidor TURN dentro del software afectado. Un atacante podría explotar este problema mediante el envío de tráfico de red especialmente diseñado al software afectado. Una explotación con éxito podría permitir al atacante enviar tráfico por medio del software afectado a destinos más allá de la aplicación, posiblemente permitiendo al atacante conseguir acceso no autorizado a la red

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2019-12-12 CVE Reserved
  • 2020-11-18 CVE Published
  • 2023-08-04 EPSS Updated
  • 2024-11-13 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
  • CWE-284: Improper Access Control
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Expressway
Search vendor "Cisco" for product "Expressway"
 < x12.6.3
Search vendor "Cisco" for product "Expressway" and version " < x12.6.3"
-
Affected
Cisco
Search vendor "Cisco"
 Telepresence Video Communication Server
Search vendor "Cisco" for product "Telepresence Video Communication Server"
 < x12.6.3
Search vendor "Cisco" for product "Telepresence Video Communication Server" and version " < x12.6.3"
-
Affected