Main Vulnerability Database Vulnerabilities #VU51966

Code Injection in Cisco Systems, Inc products - CVE-2021-1362

Published: April 7, 2021

Vulnerability identifier: #VU51966

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1362

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the SOAP API endpoint. A remote user can send a specially crafted SOAP API request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Unified Communications Manager (CallManager)
Cisco Unified Communications Manager Session Management Edition
Cisco Unified Communications Manager IM & Presence Service
Cisco Unity Connection
Cisco Prime License Manager

How to mitigate CVE-2021-1362

Install updates from vendor's website.

Unified Communications Manager (CallManager) - addressed in versions 11.5.1 SU9, 12.5.1 SU4
Cisco Unified Communications Manager IM & Presence Service - addressed in versions 11.5.1 SU9, 12.5.1 SU4
Cisco Unified Communications Manager Session Management Edition - addressed in versions 11.5.1 SU9, 12.5.1 SU4
Cisco Unity Connection - addressed in versions 11.5.1 SU9, 12.5.1 SU4
Cisco Prime License Manager - addressed in versions 11.5.1 SU9, 12.5.1 SU4

External References

Related Security Bulletins