CVE-2011-3294

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-10-19 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the login page in the administrative interface on Cisco TelePresence Video Communication Servers (VCS) with software before X7.0 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, aka Bug ID CSCts80342.

Affected products

Cisco Telepresence Video Communication Servers: all versions
Cisco Telepresence Video Communication Servers Software: through x6.1; x5.2, x6.0

References

http://securitytracker.com/id?1026186
http://www.cisco.com/en/US/products/products_security_response09186a0080b98d0b.html
http://www.securityfocus.com/bid/50084
https://exchange.xforce.ibmcloud.com/vulnerabilities/70563
http://securitytracker.com/id?1026186
http://www.cisco.com/en/US/products/products_security_response09186a0080b98d0b.html
http://www.securityfocus.com/bid/50084
https://exchange.xforce.ibmcloud.com/vulnerabilities/70563

Get alerted when CVE-2011-3294 or the next vulnerability affects your stack