Detections
Analytics
Cisco Expressway Series Information Disclosure (cisco-sa-expressway-inf-disc-vvYqgSTS)
medium Nessus Plugin ID 371141
Synopsis
The remote device is missing a vendor-supplied security patch.Description
According to its self-reported version, Cisco Expressway Series is affected by an information disclosure vulnerability.- A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access.
Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. (CVE-2026-76435)
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug ID CSCww11368See Also
Plugin Details
Severity: Medium
ID: 371141
File Name: cisco-sa-expressway-inf-disc-vvYqgSTS.nasl
Version: 1.1
Type: Remote
Family: CISCO
Published: 10/23/2026
Updated: 10/23/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-76435
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability Information
CPE: cpe:/a:cisco:telepresence_video_communication_server_software, cpe:/h:cisco:telepresence_video_communication_server
Required KB Items: Cisco/TelePresence_VCS/Version
Patch Publication Date: 10/21/2026
Vulnerability Publication Date: 10/21/2026
Reference Information
CVE: CVE-2026-76435