PT-2019-4243 · Cisco · Cisco Unity Express

Published 2019-11-20 · Updated 2021-10-29 · CVE-2019-15986

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unity Express (affected versions not specified)

Description The issue is related to the improper handling of special elements, which can be exploited to elevate privileges and execute arbitrary code. An authenticated, local attacker could inject arbitrary commands that are executed with root privileges by sending crafted CLI commands to the system. This is due to improper input validation for certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2019-04844

CVE-2019-15986

Affected Products

Cisco Unity Express

References · 4

• https://bdu.fstec.ru/vul/2019-04844 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15986 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-unity-exp-comm-inject · Vendor Advisory