CVE-2014-7991 — The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376

Back Back to CVE browser

MEDIUM

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376

Published Nov 14, 2014

4.3

MEDIUM

CVSS 2.0

EPSS 0.68%

Description

The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.68% 0.00678

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00678

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.68% (0.00678)	50.53th	v5 (v2026.06.15)
Jun 15, 2026	0.68% (0.00678)	47.29th	v5 (v2026.06.15)
Mar 17, 2025	0.28% (0.00278)	49.12th	v4 (v2025.03.14)
Dec 12, 2024	0.11% (0.00112)	46.38th	v3 (v2023.03.01)
Jun 20, 2024	0.11% (0.00110)	44.53th	v3 (v2023.03.01)
Mar 7, 2023	0.11% (0.00110)	42.52th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Sep 17, 2022	1.11% (0.01108)	53.57th	v2 (v2022.01.01)
Apr 1, 2022	1.11% (0.01108)	51.54th	v2 (v2022.01.01)
Feb 4, 2022	1.11% (0.01108)	29.61th	v2 (v2022.01.01)

Weaknesses (1)

CWE-310

References (6)

http://secunia.com/advisories/62267
third-party-advisoryx_refsource_SECUNIA
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991
vendor-advisoryx_refsource_CISCOVendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=36381
x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/71013
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1031181
vdb-entryx_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/98574
vdb-entryx_refsource_XF

Link	Providers	Tags
http://secunia.com/advisories/62267		third-party-advisoryx_refsource_SECUNIA
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991		vendor-advisoryx_refsource_CISCOVendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=36381		x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/71013		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1031181		vdb-entryx_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/98574		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner cisco

Published Nov 14, 2014

Updated Aug 6, 2024

Reserved Oct 8, 2014

Link CVE-2014-7991

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-7991

Red Hat

Severity n/a

Public date n/a

Links CVE-2014-7991