CVE-2017-3792: A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticat...

Description

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675.

Metrics

EPSS Probability

6.84%

93.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Cisco	Telepresence Mcu Software	4.3_\(1.68\)
Cisco	Telepresence Mcu Software	4.3_\(2.18\)
Cisco	Telepresence Mcu Software	4.3_\(2.30\)
Cisco	Telepresence Mcu Software	4.3_\(2.32\)
Cisco	Telepresence Mcu Software	4.4_\(3.42\)
Cisco	Telepresence Mcu Software	4.4_\(3.49\)
Cisco	Telepresence Mcu Software	4.4_\(3.54\)
Cisco	Telepresence Mcu Software	4.4_\(3.57\)
Cisco	Telepresence Mcu Software	4.4_\(3.67\)
Cisco	Telepresence Mcu Software	4.5_\(1.45\)
Cisco	Telepresence Mcu Software	4.5_\(1.55\)
Cisco	Telepresence Mcu Software	4.5_\(1.71\)
Cisco	Telepresence Mcu Software	4.5_\(1.72\)
Cisco	Telepresence Mcu Software	4.5_\(1.85\)

References

http://www.securityfocus.com/bid/95787Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037698
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-telepresenceVendor Advisory
http://www.securityfocus.com/bid/95787Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037698
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-telepresenceVendor Advisory

Timeline

Published: Feb 1, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-3792?

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675.

How severe is CVE-2017-3792?

Severity scoring for CVE-2017-3792 is pending analysis. The EPSS model estimates a 6.84% probability of exploitation in the next 30 days.

How do I fix CVE-2017-3792?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.