Skip to content
Fencer Intel
high 7.4

CVE-2018-0263 json

A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal devi…

published 2018-06-07 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1086

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an affected system. The vulnerability is due to incorrect default configuration of the device, which can expose internal interfaces and ports on the external interface of the system. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files and sensitive meeting information on an affected system. This vulnerability affects Cisco Meeting Server (CMS) 2000 Platforms that are running a CMS Software release prior to Release 2.2.13 or Release 2.3.4. Cisco Bug IDs: CSCvg76471.

Patch / fix

  • cisco meeting_server 2.2.13, 2.3.4

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD 2.0 3.3 AV:A/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a Cisco Meeting Server unknown

Classification

Weakness
  • CWE-16 Configuration
  • CWE-1188 Initialization of a Resource with an Insecure Default

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.