CVE-2023-20255

mediumpriority · track · 21EPSS 0.008 · 57 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.81% (57th) EPSS

CVSS 5.3 · medium

Is it mine?

4 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisco_csaf

EPSS · scored 2026-10-28

A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause a partial availability condition, which could cause ongoing video calls to be dropped due to the invalid packets reaching the Web Bridge.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco Meeting Servercisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · psirt@cisco.com USexploitability 3.9 · impact 1.4

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Cisco PSIRT US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20US

affected products (4)

Products and version ranges known to be affected.

Cisco Cisco Meeting Serverall versionscisco_csafUS
Cisco Cisco Meeting Server≤ N/Aenisa_euvdEU
Cisco Systems Inc. Meeting Server≤ 3.6.1fstec_bduRU
cisco meeting server< 3.6.1nvdUScpe:2.3:a:cisco:meeting_server:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2800Cisco Meeting Server: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-11-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Meeting Server ausnutzen, um einen Denial of Service Angriff durchzuführen.
cisco-sa-cms-segfault-G6ES4Ve8Cisco Meeting Server Web Bridge Denial of Service Vulnerability2023-11-01csaf · cisco_csafUS
A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause a partial availability condition, which could cause ongoing video calls to be dropped due to the invalid packets reaching the Web Bridge. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisco_csaf nvd cert_bund NVD CVE.org MITRE

published 2023-11-01modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan