Read the docs
TI-2019-01468 Aliases CVE-2019-1845GHSA-qfgg-fv6m-h7j6

Improper input validation in Cisco TelePresence Video Communication Server

Priority MEDIUM 51CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users attempting to authenticate, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient controls for specific memory operations. An attacker could exploit this vulnerability by sending a malformed Extensible Messaging and Presence Protocol (XMPP) authentication request to an affected system. A successful exploit could allow the attacker to cause an unexpected restart of the authentication service, preventing users from successfully authenticating. Exploitation of this vulnerability does not impact users who were authenticated prior to an attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04639 91st percentileScored 2026-11-07
Fix Fixed Cisco TelePresence Video Communication Server (VCS) (Cisco): 12.5(1)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco TelePresence Video Communication Server (VCS)before 12.5(1)12.5(1)Patch availableCNA
  • Cisco TelePresence Video Communication Server (VCS) VendorCisco Affected before 12.5(1) Fixed in 12.5(1) Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:*x8.1 – x12.5.2VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\):*:*:*:*:*:*:*11.5(1)VulnerableCisco
  • cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:* Versions x8.1 – x12.5.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:11.5\(1\):*:*:*:*:*:*:* Versions 11.5(1) Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco TelePresence Video Communication Server (VCS) (Cisco) Fixed in 12.5(1)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1845
  2. 2026-10-03 Alias added: GHSA-qfgg-fv6m-h7j6

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-06915 Code injection in Cisco TelePresence Video Communication Server Expressway CVSS 3.1HIGH 7.2
  • TI-2022-05314 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities CVSS 3.1CRITICAL 9.0
  • TI-2022-05313 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities CVSS 3.1CRITICAL 9.0
  • TI-2022-05371 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities CVSS 3.1CRITICAL 9.0
  • TI-2018-00368 Improper input validation in Cisco Unified Communications Manager IM & Presence Service CVSS 3.1HIGH 7.5
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences