CVE-2016-9207

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP connections to arbitrary hosts. This does not allow for full traffic proxy through the Expressway. Affected Products: This vulnerability affects Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS). More Information: CSCvc10834. Known Affected Releases: X8.7.2 X8.8.3. Known Fixed Releases: X8.9.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-20 CWE-254

Affected software

Vendor	Product	Versions
n/a	Cisco Expressway	Cisco Expressway

References

http://www.securityfocus.com/bid/94797Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037422Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-expresswayVendor Advisory
http://www.securityfocus.com/bid/94797Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037422Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-expresswayVendor Advisory

Timeline

Published: Dec 14, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-92086.5A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder coul CVE-2016-92094.3A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that CVE-2016-92107.5A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthentica CVE-2016-92117.5A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote CVE-2016-92127.5A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances CVE-2016-92146.1Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site s CVE-2016-92157.8A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the roo CVE-2016-92165.3An IKE Packet Parsing Denial of Service Vulnerability in the ipsecmgr process of Cisco ASR 5000 Software could allow an unauthenticated, rem CVE-2016-92178.8A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote att CVE-2016-92188.8A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF CVE-2016-92197.5A vulnerability with IPv6 UDP ingress packet processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remo CVE-2016-92204.3A Denial of Service Vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could