PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3830 Cisco CVE debrief

CVE-2017-3830 is a high-severity denial-of-service issue in Cisco Meeting Server (CMS). According to Cisco and NVD, an unauthenticated remote attacker could trigger a DoS condition through an internal API on affected appliances. Cisco lists CMS 2.1.0 as affected and 2.1.2 as the fixed release.

Vendor
Cisco
Product
CVE-2017-3830
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

Cisco Meeting Server administrators, infrastructure teams responsible for CMS appliances, and defenders monitoring externally reachable collaboration services.

Technical summary

NVD characterizes the issue as network-exploitable with low attack complexity, no privileges required, and no user interaction (CVSS v3.0: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The weakness is mapped to CWE-20. The affected CPE entry identifies Cisco Meeting Server 2.1.0, and Cisco’s advisory points to 2.1.2 as the fixed release.

Defensive priority

High. The vulnerability is remotely reachable, requires no authentication, and can disrupt service availability on affected CMS appliances.

Recommended defensive actions

  • Upgrade Cisco Meeting Server to 2.1.2 or later as soon as practical.
  • Confirm whether any Cisco Meeting Server 2.1.0 systems remain in inventory, including test or standby appliances.
  • Review Cisco’s advisory for product-specific mitigation guidance and deployment notes.
  • Restrict network exposure of CMS services and related interfaces to trusted management and collaboration networks.
  • Monitor for unexpected service interruption or restart behavior on affected appliances while remediation is underway.

Evidence notes

All core facts are sourced from the NVD CVE record and the linked Cisco security advisory: the vulnerability affects Cisco Meeting Server 2.1.0, is remotely triggerable without authentication, can cause denial of service, and is fixed in 2.1.2. NVD also provides the CVSS v3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CWE-20 classification. The CVE was published on 2017-02-22 and later modified on 2026-05-13.

Official resources

CVE published by NVD/CVE on 2017-02-22 and modified on 2026-05-13. No KEV date is listed in the supplied source data.