High severity · published Apr 8, 2021
CVE-2021-1362
A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications…
8.8
CVSS
2.7%
EPSS
No
On KEV
Description
A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Prime License Manager · Cisco
10.5\(2\) before 11.5\(1\)su9 · source: NVD
UC
Unified Communications Manager · Cisco
10.5\(2\) before 11.5\(1\)su9; 10.5\(2\) before 11.5\(1\)su9; 12.0\(1\) before 12.5\(1\)su4; 12.0\(1\) before 12.5\(1\)su4 · source: NVD
UC
Unified Communications Manager IM & Presence Service · Cisco
10.5\(2\) before 11.5\(1\)su9; 12.0\(1\) before 12.5\(1\)su4 · source: NVD
UC
Unity Connection · Cisco
10.5\(2\) before 11.5\(1\)su9; 12.0\(1\) before 12.5\(1\)su4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-1362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-1362
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-pqVYwyb
More from Prime License Manager
9.8
CVE-2020-3140
A vulnerability in the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthorized access to an…
9.8
CVE-2018-15441
A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries
9.8
CVE-2017-12337
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote…
7.5
CVE-2017-6779
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated,…
6.5
CVE-2021-1226
A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified…