CVE-2014-7991

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-14 · updated 2026-06-17
Weakness: CWE-310

Description

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376.

Affected products

Cisco Unified Communications Manager: through 10.0\(1\); 10.0

References

http://secunia.com/advisories/62267
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991
http://tools.cisco.com/security/center/viewAlert.x?alertId=36381
http://www.securityfocus.com/bid/71013
http://www.securitytracker.com/id/1031181
https://exchange.xforce.ibmcloud.com/vulnerabilities/98574
http://secunia.com/advisories/62267
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991
http://tools.cisco.com/security/center/viewAlert.x?alertId=36381
http://www.securityfocus.com/bid/71013
http://www.securitytracker.com/id/1031181
https://exchange.xforce.ibmcloud.com/vulnerabilities/98574

Get alerted when CVE-2014-7991 or the next vulnerability affects your stack