CVE-2011-2538

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-29 · updated 2026-06-16
Weakness: CWE-74

Description

Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitrary commands.

Affected products

Cisco TelePresence Video Communication Server (VCS) Expressway: before x7.0.3 — fixed in x7.0.3

How to fix

Upgrade to a fixed version: Cisco TelePresence Video Communication Server (VCS) Expressway x7.0.3. Check the vendor advisory for mitigations.

References

https://www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/vcs/release_note/Cisco_VCS_Release_Note_X7-0-3.pdf
https://www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/vcs/release_note/Cisco_VCS_Release_Note_X7-0-3.pdf

Get alerted when CVE-2011-2538 or the next vulnerability affects your stack