Buffer overflow in the Conference Control Protocol API implementation in Cisco…
Priority LOW 39CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Buffer overflow in the Conference Control Protocol API implementation in Cisco TelePresence Server software before 4.1(2.33) on 7010, MSE 8710, Multiparty Media 310 and 320, and Virtual Machine devices allows remote attackers to cause a denial of service (device crash) via a crafted URL, aka Bug ID CSCuu28277.
Why it matters now
EPSS 0.02351 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:telepresence_server_software:2.3\(1.55\):*:*:*:*:*:*:* | 2.3(1.55) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:2.3\(1.57\):*:*:*:*:*:*:* | 2.3(1.57) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.24\):*:*:*:*:*:*:* | 3.0(2.24) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.46\):*:*:*:*:*:*:* | 3.0(2.46) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.48\):*:*:*:*:*:*:* | 3.0(2.48) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.49\):*:*:*:*:*:*:* | 3.0(2.49) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.80\):*:*:*:*:*:*:* | 3.1(1.80) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.82\):*:*:*:*:*:*:* | 3.1(1.82) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.95\):*:*:*:*:*:*:* | 3.1(1.95) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.96\):*:*:*:*:*:*:* | 3.1(1.96) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:telepresence_server_software:2.3\(1.55\):*:*:*:*:*:*:* Versions 2.3(1.55) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:2.3\(1.57\):*:*:*:*:*:*:* Versions 2.3(1.57) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.24\):*:*:*:*:*:*:* Versions 3.0(2.24) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.46\):*:*:*:*:*:*:* Versions 3.0(2.46) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.48\):*:*:*:*:*:*:* Versions 3.0(2.48) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.0\(2.49\):*:*:*:*:*:*:* Versions 3.0(2.49) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.80\):*:*:*:*:*:*:* Versions 3.1(1.80) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.82\):*:*:*:*:*:*:* Versions 3.1(1.82) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.95\):*:*:*:*:*:*:* Versions 3.1(1.95) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.96\):*:*:*:*:*:*:* Versions 3.1(1.96) Vulnerable ·Cisco
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.97\):*:*:*:*:*:*:* | 3.1(1.97) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.98\):*:*:*:*:*:*:* | 3.1(1.98) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:4.0\(1.57\):*:*:*:*:*:*:* | 4.0(1.57) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:4.0\(2.8\):*:*:*:*:*:*:* | 4.0(2.8) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:telepresence_server_software:4.1\(1.79\):*:*:*:*:*:*:* | 4.1(1.79) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:telepresence_server_7010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:telepresence_server_mse_8710:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:telepresence_server_on_multiparty_media_310:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:telepresence_server_on_multiparty_media_320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:telepresence_server_on_virtual_machine:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.97\):*:*:*:*:*:*:* Versions 3.1(1.97) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:3.1\(1.98\):*:*:*:*:*:*:* Versions 3.1(1.98) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:4.0\(1.57\):*:*:*:*:*:*:* Versions 4.0(1.57) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:4.0\(2.8\):*:*:*:*:*:*:* Versions 4.0(2.8) Vulnerable ·Cisco
- cpe:2.3:a:cisco:telepresence_server_software:4.1\(1.79\):*:*:*:*:*:*:* Versions 4.1(1.79) Vulnerable ·Cisco
- cpe:2.3:h:cisco:telepresence_server_7010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:telepresence_server_mse_8710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:telepresence_server_on_multiparty_media_310:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:telepresence_server_on_multiparty_media_320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:telepresence_server_on_virtual_machine:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-6284
- 2026-10-03 Alias added: GHSA-jcf7-3f5g-p5qv
References
More Cisco Telepresence Server Software vulnerabilities
- TI-2015-00664 The web framework in Cisco TelePresence Advanced Media Gateway Series Software before… CVSS 2.0HIGH 9.0
- TI-2013-01022 The DSP card on Cisco TelePresence MCU 4500 and 4501 devices before 4.3(2.30)… CVSS 2.0HIGH 7.1
- TI-2015-05291 Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software… CVSS 2.0MEDIUM 6.8
- TI-2015-00611 Cisco Virtual TelePresence Server Software does not properly restrict use of the serial… CVSS 2.0HIGH 7.2
- TI-2017-02913 Cleartext transmission of sensitive information in Cisco TelePresence Server CVSS 3.0MEDIUM 5.3
- TI-2014-02659 Multiple cross-site scripting (XSS) vulnerabilities in the login page in the… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2015-6284 · CVE Program
- CVE-2015-6284 · NVD
- FIRST EPSS
- GHSA-jcf7-3f5g-p5qv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences