PT-2017-17196 · Cisco · Cisco Unified Contact Center Enterprise

Published 2017-05-03 · Updated 2017-07-11 · CVE-2017-6626

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Enterprise (UCCE) versions 11.5(1) through 11.6(1)

Description A vulnerability exists due to an undocumented, hard-coded password for a user account. This allows an unauthenticated, remote attacker to retrieve information from agents using the Finesse Desktop by subscribing to the Finesse Notification Service. The attacker can receive notifications when an agent signs in or out, when information about an agent changes, or when an agent's state changes.

Recommendations For versions 11.5(1) and 11.6(1), update the system to remove the hard-coded password and ensure that all user accounts have secure, unique passwords. As a temporary workaround, consider restricting access to the Finesse Notification Service to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-6626

Affected Products

Cisco Unified Contact Center Enterprise

References · 5

• https://osv.dev/vulnerability/CVE-2017-6626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6626 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-finesse-ucce · Vendor Advisory
• http://securityfocus.com/bid/98291 · Note
• http://securitytracker.com/id/1038396 · Note