PT-2022-6867 · Cisco · Cisco Unified Communications Manager+3
Published
2022-10-27
·
Updated
2024-01-25
·
CVE-2023-20266
CVSS v2.0
7.9
High
| Vector | AV:N/AC:M/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Emergency Responder (affected versions not specified)
Cisco Unified Communications Manager (affected versions not specified)
Cisco Unified Communications Manager Session Management Edition (affected versions not specified)
Cisco Unity Connection (affected versions not specified)
Description
A vulnerability in the mentioned Cisco products could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This issue exists because the application does not properly restrict the files used for upgrades. An attacker could exploit this by providing a crafted upgrade file, allowing them to elevate privileges to root. The attacker must have valid platform administrator credentials on an affected device to exploit this vulnerability.
Recommendations
For Cisco Emergency Responder, consider disabling the upgrade feature until a patch is available.
For Cisco Unified Communications Manager, restrict access to upgrade files to minimize the risk of exploitation.
For Cisco Unified Communications Manager Session Management Edition, avoid using crafted upgrade files until the issue is resolved.
For Cisco Unity Connection, as a temporary workaround, consider restricting administrator access to the system until a fix is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Privilege Management
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Emergency Responder
Cisco Unified Communications Manager
Cisco Unified Communications Manager Session Management Edition
Cisco Unity Connection