Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Pres...

CVE-2021-1362 · published 5 years ago
Summary

A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, rem...

What to do
  • Update cisco prime_license_manager to version 11.5\(1\)su9 or later.
Affected software
VendorProductAffected versions
cisco prime_license_manager >= 10.5\(2\), < 11.5\(1\)su9
cpe:2.3:a:cisco:prime_license_manager:*:*:*:*:*:*:*:*
cisco unified_communications_manager >= 10.5\(2\), < 11.5\(1\)su9
>= 12.0\(1\), < 12.5\(1\)su4
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*
cisco unified_communications_manager_im_\&_presence_service >= 10.5\(2\), < 11.5\(1\)su9
>= 12.0\(1\), < 12.5\(1\)su4
cpe:2.3:a:cisco:unified_communications_manager_im_\&_presence_service:*:*:*:*:*:*:*:*
cisco unity_connection >= 10.5\(2\), < 11.5\(1\)su9
>= 12.0\(1\), < 12.5\(1\)su4
cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &amp; Pres...
A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &amp; Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
3% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published8 Apr 2021
Updated28 Oct 2026
First seen29 Sep 2026
Sources
CVE-2021-1362 · NVD
Track software like this
Free during beta