Cisco Unified CM flaw lets remote attackers bypass access control
Original title: Cisco Unified Communications Manager Improper Access Control Vulnerability
Crafted HTTP requests can reach network areas beyond intended access on Unified CM and Unified CM SME; updates exist and workarounds do not.
Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition contain an improper access-control flaw. Improper validation of specific HTTP requests lets an unauthenticated remote attacker send a crafted request to an affected device. A successful exploit can reach parts of the network beyond the attacker's intended access. Cisco has released software updates and says no workarounds address the vulnerability.
Unconfirmed: Affected versions, fixed versions, and exploitation status are not stated in the snippet.
- Both Unified CM and Unified CM SME are affected.
- The cause is improper input validation of specific HTTP requests.
- Attackers need no authentication to send the crafted request.
- Cisco released updates and says no workarounds exist.
Impact: Access network areas beyond intended access
| Product | Affected |
|---|---|
| Cisco Unified Communications Manager | — |
| Cisco Unified Communications Manager Session Management Edition | — |
- 1.Install the Cisco software updates that address this vulnerability.
- Vendors
- Cisco
From the original article
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.