PT-2013-6248 · Cisco · Cisco Unified Communications Manager

Published 2013-12-12 · Updated 2024-10-29 · CVE-2013-7030

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (affected versions not specified)

Description The TFTP service allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discovering a cleartext UseUserCredential field in an SPDefault.cnf.xml file. The vendor reportedly disputes the significance of this report, stating that this is an expected default behavior, and that the product's documentation describes use of the TFTP Encrypted Config option in addressing this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-7030

Affected Products

Cisco Unified Communications Manager

References · 8

• 🔥 https://exploit-db.com/exploits/30237 · Exploit
• 🔥 http://exploit-db.com/exploits/30237 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-7030 · Security Note
• http://osvdb.org/100916 · Note
• https://t.me/cvenotify/83668 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89649 · Note
• https://t.me/cvenotify/99863 · Telegram Post
• https://t.me/cvenotify/89491 · Telegram Post