Main Vulnerability Database Vulnerabilities #VU52933

Improper access control in Unified Communications Manager (CallManager) and Cisco Unified Communications Manager Session Management Edition - CVE-2021-1478

Published: May 6, 2021

Vulnerability identifier: #VU52933

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1478

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Java Management Extensions (JMX) component. A remote attacker can access the port and restart the JMX process, leading to denial of service (DoS) condition.

Affected software

Unified Communications Manager (CallManager)
Cisco Unified Communications Manager Session Management Edition

How to mitigate CVE-2021-1478

Install updates from vendor's website.

Unified Communications Manager (CallManager) - update to 12.6
Cisco Unified Communications Manager Session Management Edition - update to 12.6

External References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-dos-OO4SRYEf

Related Security Bulletins