PT-2018-1847 · Cisco · Cisco Unity Express

Published 2018-11-07 · Updated 2019-10-09 · CVE-2018-15381

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unity Express (affected versions not specified)

Description The issue is related to a Java deserialization vulnerability. It occurs when the software insecurely deserializes user-supplied content, specifically Java objects, through the Java Remote Method Invocation (RMI) service. This could allow a remote attacker to execute arbitrary shell commands with the privileges of the root user. The attacker could exploit this by sending a malicious serialized Java object to the RMI service.

Recommendations For Cisco Unity Express, consider disabling the Java RMI service until a patch is available to prevent exploitation. Restrict access to the Java deserialization functionality to minimize the risk of arbitrary command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2018-01449

CVE-2018-15381

Affected Products

Cisco Unity Express

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-15381 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15381 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01449 · Security Note
• http://securityfocus.com/bid/105876 · Note
• http://securitytracker.com/id/1042130 · Note