$ cve CVE-2017-3792 JSON

CVE-2017-3792

9.8

CRITICAL · CVSS 3.0 · EPSS 6.8% (pctl 94)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	6.84% — more likely to be exploited than 94% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	none known
Published	2017-02-01
Last modified	2026-06-17

Affected (8)

Vendor	Product
cisco	telepresence mcu 4505
cisco	telepresence mcu 4510
cisco	telepresence mcu 4515
cisco	telepresence mcu 4520
cisco	telepresence mcu 5310
cisco	telepresence mcu 5320
cisco	telepresence mcu mse 8510
cisco	telepresence mcu software

References

→ the Explorer · watch your stack · NVD