Cisco Expressway-C and TelePresence VCS Vulnerability: Unauthorized Access to Sensitive Data possible via SSL Certificate Validation Flaw

CVE-2022-20814

Summary

A vulnerability exists in the certificate validation process of Cisco Expressway-C and Cisco TelePresence VCS, which could be exploited by an unauthenticated remote attacker. This flaw arises from inadequate validation of the SSL server certificate during connections to Cisco Unified Communications Manager devices. An attacker may leverage a man-in-the-middle technique to intercept communication between devices, potentially impersonating the endpoint with a self-signed certificate. Successful exploitation may enable access to sensitive data or allow for the manipulation of transmitted information. Cisco has released updates addressing this vulnerability, with no available workarounds.

References