Unified Communications Manager vulnerabilities | LiveThreat CVE Feed

Product

Unified Communications Manager

by Cisco · last CVE Jun 3, 2026

On CISA KEVExploited in the wild

238

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities238 In the news7 Timeline

Severity mix

Critical 4High 24Medium 75Low 0

Severity

All severities238 Critical4 High24 Medium75 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add Unified Communications Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2013-6978	–	2%	Dec 21	The disaster recovery system (DRS) component in Cisco Unified Communications Manager (UCM) 9.1(1) and earlier allows remote authenticated users to obtain sensitive device… Affected: through 9.1\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +34 more
CVE-2013-6689	–	0%	Nov 18	Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier allows local users to bypass file permissions, and read, modify, or create arbitrary files, via an "overload"… Affected: through 9.1\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +34 more
CVE-2013-6688	–	2%	Nov 18	Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager (ELM) component in Cisco Unified Communications Manager 9.1(1) and earlier… Affected: through 9.1\(1\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +34 more
CVE-2013-5555	–	1%	Nov 1	Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to cause a denial of service (service restart) via a crafted SIP message, aka Bug ID… Affected: All versions, or not specified
CVE-2013-5528	–	23%	Oct 11	Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via… Affected: All versions, or not specified
CVE-2013-3472	–	1%	Aug 29	Cross-site request forgery (CSRF) vulnerability in the Enterprise License Manager (ELM) in Cisco Unified Communications Manager (CM) allows remote attackers to hijack the… Affected: All versions, or not specified
CVE-2013-3462	–	3%	Aug 25	Buffer overflow in Cisco Unified Communications Manager (Unified CM) 7.1(x) before 7.1(5b)su6, 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a)su3, and 9.x before 9.1(2) allows… Affected: 8.6; 8.6(1); 8.6(1a); 8.6(2); 8.6(2a); 8.6(2a)su1; +34 more
CVE-2013-3461	–	1%	Aug 25	Cisco Unified Communications Manager (Unified CM) 8.5(x) and 8.6(x) before 8.6(2a)su3 and 9.x before 9.1(1) does not properly restrict the rate of SIP packets, which allows remote… Affected: 9.0(1); 8.5; 8.5(1); 8.5(1)su1; 8.5(1)su2; 8.5(1)su3; +9 more
CVE-2013-3460	–	2%	Aug 25	Memory leak in Cisco Unified Communications Manager (Unified CM) 8.5(x) before 8.5(1)su6, 8.6(x) before 8.6(2a)su3, and 9.x before 9.1(1) allows remote attackers to cause a denial… Affected: 8.6; 8.6(1); 8.6(1a); 8.6(2); 8.6(2a); 8.6(2a)su1; +9 more
CVE-2013-3459	–	1%	Aug 25	Cisco Unified Communications Manager (Unified CM) 7.1(x) before 7.1(5b)su6a does not properly handle errors, which allows remote attackers to cause a denial of service (service… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +17 more
CVE-2013-3453	–	2%	Aug 22	Memory leak in Cisco Unified Communications Manager IM and Presence Service before 8.6(5)SU1 and 9.x before 9.1(2), and Cisco Unified Presence, allows remote attackers to cause a… Affected: through 8.6\(4\); 3.3(5); 3.3(5)sr1; 3.3(5)sr2a; 4.1(3); 4.1(3)sr1; +34 more
CVE-2013-3451	–	1%	Aug 5	Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Unified Communications Manager (Unified CM) allow remote attackers to hijack the authentication of arbitrary… Affected: All versions, or not specified
CVE-2013-3450	–	1%	Aug 5	Cross-site request forgery (CSRF) vulnerability in the User WebDialer page in Cisco Unified Communications Manager (Unified CM) allows remote attackers to hijack the… Affected: All versions, or not specified
CVE-2013-3442	–	1%	Aug 5	The web portal in Cisco Unified Communications Manager (Unified CM) allows remote authenticated users to obtain sensitive stack-trace information via unspecified vectors that… Affected: All versions, or not specified
CVE-2013-4869	–	1%	Jul 18	Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1(2) use the same CTI and… Affected: 7.1\(1\) through 9.1\(2\)
CVE-2013-3434	–	0%	Jul 18	Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privileges by leveraging unspecified… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +34 more
CVE-2013-3433	–	0%	Jul 18	Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privileges by leveraging unspecified… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +34 more
CVE-2013-3412	–	1%	Jul 18	SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execute arbitrary SQL commands via… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +34 more
CVE-2013-3404	–	1%	Jul 18	SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows remote attackers to execute arbitrary SQL commands via unspecified… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +34 more
CVE-2013-3403	–	0%	Jul 18	Multiple untrusted search path vulnerabilities in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allow local users to gain privileges by leveraging unspecified… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +34 more
CVE-2013-3402	–	2%	Jul 18	An unspecified function in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execute arbitrary commands via unknown vectors,… Affected: 7.1(2a); 7.1(2a)su1; 7.1(2b); 7.1(2b)su1; 7.1(3); 7.1(3a); +34 more
CVE-2013-3397	–	1%	Jun 26	Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability component in Cisco Unified Communications Manager (CUCM) allows remote attackers to hijack the… Affected: All versions, or not specified
CVE-2013-1188	–	1%	May 16	Cisco Unified Communications Manager (CUCM) does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service (application… Affected: All versions, or not specified
CVE-2013-1240	–	0%	May 4	The command-line interface in Cisco Unified Communications Manager (CUCM) does not properly validate input, which allows local users to read arbitrary files via unspecified… Affected: All versions, or not specified
CVE-2013-1134	–	1%	Feb 27	The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the… Affected: 9.0(1)
CVE-2013-1133	–	1%	Feb 27	Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU… Affected: 8.6; 8.6(1); 8.6(1a); 8.6(2); 8.6(2a); 8.6(2a)su1; +2 more
CVE-2012-3949	–	3%	Sep 27	The SIP implementation in Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su5, 8.x before 8.5(1)su4, and 8.6 before 8.6(2a)su1; Cisco IOS 12.2 through 12.4… Affected: 6.0(1a); 6.0(1b); 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); +33 more
CVE-2012-0376	–	1%	May 3	The voice-sipstack component in Cisco Unified Communications Manager (CUCM) 8.5 allows remote attackers to cause a denial of service (core dump) via vectors involving SIP messages… Affected: 8.5
CVE-2011-4019	–	1%	May 3	Memory leak in Cisco IOS 12.4 and 15.0 through 15.2, and Cisco Unified Communications Manager (CUCM) 7.x, allows remote attackers to cause a denial of service (memory consumption)… Affected: 7.0; 7.0(1); 7.0(1)su1; 7.0(1)su1a; 7.0(2); 7.0(2a); +27 more
CVE-2011-4487	–	1%	Mar 1	SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1… Affected: 6.0; 6.0(1); 6.0(1a); 6.0(1b); 6.1(1); 6.1(1a); +34 more
CVE-2011-4486	–	1%	Mar 1	Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000… Affected: 6.0; 6.0(1); 6.0(1a); 6.0(1b); 6.1(1); 6.1(1a); +34 more
CVE-2011-0941	–	1%	Nov 1	Memory leak in Cisco Unified Communications Manager (CUCM) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1), and Cisco IOS 12.4 and 15.1,… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-3315	–	26%	Oct 27	Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified… Affected: 5.0; 5.1; 5.1(1); 5.1(1b); 5.1(1c); 5.1(2); +34 more
CVE-2011-2072	–	2%	Oct 3	Memory leak in Cisco IOS 12.4, 15.0, and 15.1, Cisco IOS XE 2.5.x through 3.2.x, and Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su4, 8.x before… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-2564	–	2%	Aug 29	Unspecified vulnerability in the Service Advertisement Framework (SAF) in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 8.x before 8.5(1) and Cisco… Affected: 8.0; 8.0(1); 8.0(2c); 8.0(2c)su1; 8.0(3); 8.0(3a); +3 more
CVE-2011-2563	–	2%	Aug 29	Unspecified vulnerability in the Service Advertisement Framework (SAF) in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 8.x before 8.5(1) and Cisco… Affected: 8.0; 8.0(1); 8.0(2c); 8.0(2c)su1; 8.0(3); 8.0(3a); +3 more
CVE-2011-2562	–	1%	Aug 29	Unspecified vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-2561	–	1%	Aug 29	The SIP process in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.x before 7.1(5b)su4 and 8.x before 8.0(1) does not properly handle SDP data within a SIP… Affected: 7.0(1)su1; 7.0(1)su1a; 7.0(2); 7.0(2a); 7.0(2a)su1; 7.0(2a)su2; +21 more
CVE-2011-2560	–	2%	Aug 29	The Packet Capture Service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x does not properly handle idle TCP connections, which allows remote… Affected: 4.1(3); 4.1(3)sr1; 4.1(3)sr2; 4.1(3)sr3; 4.1(3)sr4; 4.2; +8 more
CVE-2011-1643	–	2%	Aug 29	Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x, 7.x before 7.1(5b)su4, 8.0, and 8.5 before 8.5(1)su2 and Cisco Unified Presence Server 6.x, 7.x, 8.0,… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-1610	–	25%	May 3	Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-1609	–	20%	May 3	SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-1607	–	2%	May 3	Directory traversal vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5b)su3, 8.0 before 8.0(3a)su1, and… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-1606	–	3%	May 3	Unspecified vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-1605	–	3%	May 3	Unspecified vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su2, 8.0 before 8.0(3), and 8.5 before… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2011-1604	–	3%	May 3	Memory leak in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5b)su3, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2010-3039	–	9%	Nov 9	/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute… Affected: 6.0; 6.1(1); 6.1(1a); 6.1(1b); 6.1(2); 6.1(2)su1; +34 more
CVE-2010-2835	–	2%	Sep 23	Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before… Affected: 6.0; 6.0(1.2114.1); 6.0(1.2121.1); 6.0(1b); 6.1(1); 6.1(1a); +31 more
CVE-2010-2834	–	2%	Sep 23	Cisco IOS 12.2 through 12.4 and 15.0 through 15.1, Cisco IOS XE 2.5.x and 2.6.x before 2.6.1, and Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before… Affected: 6.0; 6.0(1.2114.1); 6.0(1.2121.1); 6.0(1b); 6.1(1); 6.1(1a); +34 more
CVE-2010-2838	–	1%	Aug 26	The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.0SU before 7.0(2a)SU3, 7.1 before 7.1(5), and 8.0 before… Affected: through 7.0\(2a\)su2; 7.0(1)su1; 7.0(1)su1a; 7.0(2); 7.0(2a); 7.0(2a)su1; +19 more