PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3792 Cisco CVE debrief

CVE-2017-3792 is a critical, network-reachable flaw in Cisco TelePresence MCU Software that can be triggered by an unauthenticated remote attacker. Improper size validation during fragmented IPv4/IPv6 packet reassembly can overflow a buffer, creating a path to arbitrary code execution or a denial of service on affected MCU systems in Passthrough content mode.

Vendor
Cisco
Product
Telepresence Mcu Software
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Cisco TelePresence MCU 5300 Series, TelePresence MCU MSE 8510, and TelePresence MCU 4500 deployments, especially systems running TelePresence MCU Software 4.3(1.68) or later with Passthrough content mode enabled.

Technical summary

Cisco and NVD describe a vulnerability in a proprietary device driver in the kernel of Cisco TelePresence MCU Software. The issue is improper size validation when reassembling fragmented IPv4 or IPv6 packets. Crafted fragments sent to a port receiving content in Passthrough content mode may overflow a buffer. NVD lists CWE-20 and a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, consistent with remote unauthenticated impact.

Defensive priority

Urgent: the issue is remotely reachable, requires no authentication, and is scored CVSS 9.8 with potential for both code execution and DoS.

Recommended defensive actions

  • Identify whether any Cisco TelePresence MCU 5300 Series, MSE 8510, or 4500 systems are running affected TelePresence MCU Software releases and whether Passthrough content mode is enabled.
  • Apply Cisco's software updates that address the vulnerability as soon as practical.
  • Use Cisco's published mitigations if immediate patching is not possible.
  • Review exposure to the affected content-receiving ports and limit network access to the MCU where feasible.
  • Prioritize validation of every deployed MCU software build against the Cisco advisory and NVD CPE/version mapping.

Evidence notes

Cisco's advisory and the NVD record both describe unauthenticated remote exploitation via crafted IPv4/IPv6 fragments against a kernel device driver. The supplied corpus attributes the issue to improper input validation (CWE-20), reports CVSS 3.0 9.8, and states that software updates are available while workarounds are not available, though mitigations exist.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3792 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3792

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3792 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3792

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.