CVE-2016-6445

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-10-27 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.

Affected products

Cisco Meeting Server: 1.8.15, 1.8_base, 1.9.0, 1.9.2, 2.0.0, 2.0.1 (+3)

References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc
http://www.securityfocus.com/bid/93517
http://www.securitytracker.com/id/1037000
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc
http://www.securityfocus.com/bid/93517
http://www.securitytracker.com/id/1037000

Get alerted when CVE-2016-6445 or the next vulnerability affects your stack