CVE-2021-1362CWE-94

Cisco Unified Communications Products Remote Code Execution Vulnerability

High · published April 8, 2021

CVSS v3.1
8.8
EPSS
3%
Percentile
85.9
In the wild
Unconfirmed
What it is

A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02714 · 85.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2021-04-08T04:05Z
EPSS history
Timeline
  • 08 APR 04:05Z
    Cisco Unified Communications Products Remote Code Execution Vulnerability
    cvelistv5