EUVD-2026-34137
GHSA-fcv7-pchj-75c2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
Articles & Coverage 3
AnalysisAI
Server-side request forgery in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition allows remote unauthenticated attackers to write files to the underlying operating system via crafted HTTP requests, which Cisco notes can be leveraged to escalate to root. Cisco has assigned this a Critical Security Impact Rating despite the 8.6 CVSS score because of the root-escalation pathway. No public exploit identified at time of analysis, and exploitation requires the non-default WebDialer service to be enabled.
Technical ContextAI
Cisco Unified CM is the enterprise call-control platform underpinning Cisco's IP telephony deployments, and Unified CM SME is the session-routing variant used to interconnect Unified CM clusters. The flaw resides in WebDialer, a click-to-call HTTP/SOAP service that lets web applications and CTI clients initiate calls through Unified CM. CWE-918 (SSRF) is the root cause class: insufficient validation of specific HTTP request inputs causes the WebDialer endpoint to issue or process attacker-influenced requests, and in this case the SSRF primitive is powerful enough to write attacker-controlled files into the OS filesystem rather than only proxying outbound connections. Affected product per CPE is cpe:2.3:a:cisco:cisco_unified_communications_manager (version range unspecified in NVD data).
RemediationAI
Patch availability is indicated by the published Cisco Security Advisory but no exact fixed version is included in the input data, so administrators should consult https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW for the fixed Unified CM and Unified CM SME release numbers and upgrade accordingly (patch available per vendor advisory). The most effective compensating control is to disable the WebDialer service on clusters that do not require click-to-call functionality, since WebDialer is disabled by default and exploitation is contingent on it being enabled; the trade-off is loss of any CTI, contact-center, or web-initiated dialing integrations that depend on the WebDialer SOAP/HTTP endpoints. Where WebDialer must remain enabled, restrict network reachability of the WebDialer HTTP listener to a hardened administrative VLAN or jump-host subnet via firewall/ACL rules to keep the unauthenticated endpoint off general user and internet-facing networks, accepting that legitimate CTI clients must be sourced from the allowlisted networks.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today