The vulnerability arises from reachable assertions (CWE‑617). These assertions can become true when the system processes certain input, potentially causing the Expressway services to crash or restart. The primary impact is a denial of service, disrupting user connectivity without affecting data confidentiality or integrity. The description does not indicate any further compromise beyond availability. \n\n

The affected product is Cisco TelePresence Video Communication Server (VCS) Expressway. No specific version information is provided in the CVE data. \n\n

With a CVSS score of 7.5, the vulnerability poses a high risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. While the attack vector is not explicitly detailed, the reachable assertion issue suggests that an attacker could trigger the denial of service by sending specially crafted requests or inputs to the Expressway service. The lack of a public exploit does not eliminate the threat; the high severity and the nature of the flaw warrant timely remediation.