A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even afte…

Published 8 y ago 2018-01-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.4%

percentile 73%

Public exploits

none known

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even after it has been disabled via the web application. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server, which would not disable access to specifically configured user accounts, even after access had been disabled in the web application. An attacker could exploit this vulnerability by connecting to the remote support account, even after it had been disabled at the web application level. An exploit could allow the attacker to modify server configuration and gain access to customer data. Cisco Bug IDs: CSCvg46741.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 mo ago 2024-12-02

Exploit prediction (EPSS)

1.44% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.1	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
NVD	2.0	5.5	`AV:N/AC:L/Au:S/C:P/I:P/A:N`

Affected products

n/a Cisco WebEx Meetings Server

Classification

Weakness

CWE-254 7PK - Security Features
CWE-863 Incorrect Authorization

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms2 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1040236 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /bid/102773 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2018-0110
NVD: CVE-2018-0110

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary