TI-2017-02934 Aliases CVE-2017-3837 GHSA-v3v8-cv78-pwpq

Improper input validation in Cisco Meeting Server

LOW 39CWE-20Published 2017-02-22 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2.

Why it matters now

EPSS 0.02139 82nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cisco Meeting Server	Cisco Meeting Server	—	No fix listed	CNA

Cisco Meeting Server Vendor— Affected Cisco Meeting Server Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:meeting_server:2.0.0:::::::*	2.0.0	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.1:::::::*	2.0.1	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.3:::::::*	2.0.3	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.4:::::::*	2.0.4	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.5:::::::*	2.0.5	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.6:::::::*	2.0.6	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.7:::::::*	2.0.7	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.8:::::::*	2.0.8	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.0.9:::::::*	2.0.9	Vulnerable	Cisco
cpe:2.3:a:cisco:meeting_server:2.1.0:::::::*	2.1.0	Vulnerable	Cisco

cpe:2.3:a:cisco:meeting_server:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Cisco
cpe:2.3:a:cisco:meeting_server:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Cisco

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:meeting_server:2.1.1:::::::*	2.1.1	Vulnerable	Cisco

cpe:2.3:a:cisco:meeting_server:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-3837
2026-10-03 Alias added: GHSA-v3v8-cv78-pwpq

References

Advisory 1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1

TI-2016-05530 Memory corruption in Cisco Meeting Server before 2.0.3 and Acano Server before 1.9.5 CVSS 3.0CRITICAL 9.8
TI-2016-05529 Memory corruption in Cisco Meeting Server before 2.0.1, Acano Server before 1.9.3, Cisco… CVSS 3.0CRITICAL 9.8
TI-2018-00239 Improper input validation in Cisco Meeting Server Media Services CVSS 3.0HIGH 7.5
TI-2017-09025 Exposure of resource to wrong sphere in Cisco Meeting Server CVSS 3.0CRITICAL 9.1
TI-2018-00222 A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker… CVSS 3.0HIGH 8.1
TI-2016-05527 Improper input validation in Cisco Meeting Server before 2.0.6 and Acano Server before… CVSS 3.0CRITICAL 9.1

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences