TI-2019-01305 Aliases CVE-2019-1679 GHSA-f4vr-c276-c5cm

Server-side request forgery in Cisco TelePresence Conductor

LOW 27CWE-918Published 2019-02-07 · Updated 2024-11-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack is commonly referred to as server-side request forgery (SSRF). The vulnerability is due to insufficient access controls for the REST API of Cisco Expressway Series and Cisco TelePresence VCS. An attacker could exploit this vulnerability by submitting a crafted HTTP request to the affected server. Versions prior to XC4.3.4 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02125 82nd percentileScored 2026-11-07

Fix Fixed Cisco TelePresence Conductor (Cisco): XC4.3.4Cisco Expressway Series (Cisco): XC4.3.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco TelePresence Conductor	before XC4.3.4	XC4.3.4	Patch available	CNA
Cisco	Cisco Expressway Series	before XC4.3.4	XC4.3.4	Patch available	CNA
Cisco	Cisco TelePresence Video Communication Server	before XC4.3.4	XC4.3.4	Patch available	CNA

Cisco TelePresence Conductor VendorCisco Affected before XC4.3.4 Fixed in XC4.3.4 Patch available CNA
Cisco Expressway Series VendorCisco Affected before XC4.3.4 Fixed in XC4.3.4 Patch available CNA
Cisco TelePresence Video Communication Server VendorCisco Affected before XC4.3.4 Fixed in XC4.3.4 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:telepresence_video_communication_server::::::::	before x12.5	Vulnerable	Cisco
cpe:2.3:a:cisco:telepresence_conductor::::::::	before xc4.3.4	Vulnerable	Cisco

cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:* Versions before x12.5 Vulnerable ·Cisco
cpe:2.3:a:cisco:telepresence_conductor:*:*:*:*:*:*:*:* Versions before xc4.3.4 Vulnerable ·Cisco

Remediation

Fix · CNA Cisco TelePresence Conductor (Cisco) Fixed in XC4.3.4
Fix · CNA Cisco Expressway Series (Cisco) Fixed in XC4.3.4
Fix · CNA Cisco TelePresence Video Communication Server (Cisco) Fixed in XC4.3.4

Timeline

2026-10-02 Threatist record created from CVE-2019-1679
2026-10-03 Alias added: GHSA-f4vr-c276-c5cm

References

Advisory 1

20190206 Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server REST API Server-Side Request Forgery Vulnerability

TI-2015-00604 The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco… CVSS 2.0HIGH 10.0
TI-2015-00603 The Session Description Protocol (SDP) implementation in Cisco TelePresence Video… CVSS 2.0HIGH 7.8
TI-2017-09063 Resource management flaw in Cisco Expressway Series and Cisco TelePresence Video… CVSS 3.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences