Code Injection in Cisco Systems, Inc products - CVE-2021-1362

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51966

Code Injection in Cisco Systems, Inc products - CVE-2021-1362

Published: April 7, 2021


Vulnerability identifier: #VU51966
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-1362
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Unified Communications Manager (CallManager)
Cisco Unified Communications Manager Session Management Edition
Cisco Unified Communications Manager IM & Presence Service
Cisco Unity Connection
Cisco Prime License Manager
Software vendor:
Cisco Systems, Inc

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the SOAP API endpoint. A remote user can send a specially crafted SOAP API request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.

External links