CVE-2014-3274

Name of the Vulnerable Software and Affected Versions Cisco TelePresence System (CTS) versions 6.0(.5)(5) and earlier

Description The issue allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, causing the system to fall back to HTTP when certain HTTPS sessions cannot be established.

Recommendations For Cisco TelePresence System (CTS) versions 6.0(.5)(5) and earlier, consider configuring the system to enforce HTTPS connections and restrict the use of HTTP to minimize the risk of exploitation.