Cisco Telepresence Video Communication Server Expressway vulnerabilities

CVE-2026-76466 [CRITICAL] CWE-798 CVE-2026-76466: A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenti A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client cer

CVE-2023-20209 [HIGH] CWE-94 CVE-2023-20209: A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePrese A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an affected device. This vulnerability is

CVE-2022-20755 [HIGH] CWE-23 CVE-2022-20755: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series a Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the ro

CVE-2022-20754 [HIGH] CWE-23 CVE-2022-20754: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series a Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the ro

CVE-2024-20252 [HIGH] CWE-352 CVE-2024-20252: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Serve Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices

CVE-2024-20254 [HIGH] CWE-352 CVE-2024-20254: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Serve Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices

CVE-2022-20814 [HIGH] CWE-295 CVE-2022-20814: A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified

CVE-2021-34716 [HIGH] CWE-460 CVE-2021-34716: A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePrese A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are

CVE-2026-76490 [HIGH] CWE-787 CVE-2026-76490: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76490 ar

CVE-2023-20192 [HIGH] CWE-20 CVE-2023-20192: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Serve Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with Administrator-level read-only credentials to elevate their privileges to Administrator with read-write credentials on an affected system. Note: "Cisco Expressway Series" refers to Cisco Expressway Contro

CVE-2026-76494 [HIGH] CWE-94 CVE-2026-76494: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are

CVE-2026-76495 [HIGH] CWE-732 CVE-2026-76495: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 ar

CVE-2026-76493 [HIGH] CWE-248 CVE-2026-76493: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76493 ar

CVE-2026-76491 [HIGH] CWE-617 CVE-2026-76491: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76491 ar

CVE-2021-34715 [HIGH] CWE-347 CVE-2021-34715: A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An

CVE-2026-76492 [HIGH] CWE-476 CVE-2026-76492: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76492 ar

CVE-2022-20812 [MEDIUM] CWE-158 CVE-2022-20812: Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Se Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expre

CVE-2022-20853 [HIGH] CWE-352 CVE-2022-20853: A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS coul A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could ex

CVE-2020-3596 [HIGH] CWE-789 CVE-2020-3596: A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePr A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handling of incoming SIP traffic. An attacker could exploit t

CVE-2020-3482 [MEDIUM] CWE-284 CVE-2020-3482: A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific connection information by the TURN server within the a