PT-2022-7016 · Cisco · Cisco Unified Communications Products

Published

2022-10-27

·

Updated

2024-01-25

·

CVE-2023-20259

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Products (affected versions not specified)
Description A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause delays with call processing. This API is not used for device management and is unlikely to be used in normal operations of the device. The vulnerability is due to improper API authentication and incomplete validation of the API request. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device, potentially causing a denial of service (DoS) condition due to high CPU utilization, which could negatively impact user traffic and management access. When the attack stops, the device will recover without manual intervention.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

SSRF

RCE

Weakness Enumeration

CWE-400CWE-918CWE-20

Related Identifiers

BDU:2023-06444
CVE-2023-20259

Affected Products

Cisco Unified Communications Products