The vulnerability lies in insufficient authorization checks for HTTP requests that process Mobile and Remote Access provisioning. An unauthenticated, remote attacker can construct a URL and send it to an affected Expressway device, allowing the attacker to read sensitive data they normally would not be able to access. The flaw is categorized as CWE‑497, which reflects improper authorization that results in information disclosure.

The weakness affects Cisco’s Expressway Series, specifically Cisco TelePresence Video Communication Server (VCS) Expressway, covering both Expressway‑Core (Expressway‑C) and Expressway‑Edge (Expressway‑E) devices. No specific firmware or software versions are listed, so the scope may include all current releases that have not yet been patched.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is exploitable remotely through HTTP traffic without any authentication. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, so there is no evidence yet that it is being actively exploited. Attackers that can reach the Expressway device over the network could craft a malicious request to the MRA provisioning URL and retrieve confidential information, potentially compromising user privacy and system integrity.