{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T11:03:53Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20120810-CVE-2012-2490","slug":"cisco-sa-20120810-cve-2012-2490","vendor":"Cisco","title":"Cisco IP Communicator Certificate Trust List Man-in-the-Middle Attack Vulnerability","summary":"Cisco IP Communicator contains a vulnerability that could allow an unauthenticated, remote attacker to conduct man-in-the-middle attacks on a targeted system. The vulnerability is due insufficient validation of signing certificates in the Certificate Trust List which have been accepted by end users. An unauthenticated, remote attacker could exploit this vulnerability by impersonating trusted servers through crafted certificates. If successful, the attacker could launch further attacks on the system. Cisco has confirmed this vulnerability and released software updates. To successfully exploit this vulnerability, Cisco IP Communicator must be restarted. An attacker may use misleading language or instructions to convince a user to restart the device, or may use other means or attacks in an attempt to restart the device. The CVSS score indicates that functional exploit code exists; however, the code is not known to be publicly available.","severity":"Medium","published_at":"2012-08-10T21:56:35Z","updated_at":"2012-08-10T21:56:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20120810-CVE-2012-2490","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20120810-CVE-2012-2490/csaf/Cisco-SA-20120810-CVE-2012-2490.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":1,"public_evidence_count":1,"kev_count":0,"highest_epss":0.00519},"cves":[{"id":"CVE-2012-2490","kev":false,"epss":{"score":0.00519,"percentile":0.40679,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"}}],"public_evidence":[{"product":{"name":"Cisco IP Communicator","slug":"cisco-ip-communicator","vendor":"Cisco"},"cve":{"id":"CVE-2012-2490"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:04:29Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco IP Communicator","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00519,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"},"published_at":"2012-08-10T21:56:35Z","updated_at":"2012-08-10T21:56:35Z","advisory_updated_at":"2012-08-10T21:56:35Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20120810-CVE-2012-2490","row_display_order":1}]}