Cisco Emergency Responder
Monthly
Cisco voice and collaboration products - Unified Communications Manager, Unified CM IM & Presence, Emergency Responder and Unity Connection (with Prime Collaboration Deployment and Unified CM SME also named in the advisory) - contain a set of internally discovered flaws in the CWE-703 improper-handling-of-exceptional-conditions class that can be triggered over the network by an unauthenticated remote attacker with no user interaction, disrupting service availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) rates this as a denial-of-service condition only, with no confidentiality or integrity impact. The issues were found during Cisco's own hardening review rather than through external reporting, and no public exploit has been identified at time of analysis; the realistic exposure depends on whether the affected collaboration nodes are reachable from untrusted networks, since these services normally sit on internal management planes.
Path traversal in Cisco Unified CM and related collaboration appliances (Emergency Responder, Prime Collaboration Deployment, Unified CM IM&P/SME, and Unity Connection) lets an authenticated local user with low privileges supply crafted file paths to escape intended directories, yielding high confidentiality, integrity, and availability impact. The flaw is CWE-22 and is addressed by Cisco hardening releases from an internal security review; no public exploit was identified at time of analysis, and exploitation requires local access plus valid low-privilege credentials (CVSS AV:L/PR:L).
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or local session holder to gain high confidentiality, integrity, and availability impact, with scope change beyond the vulnerable component. The CVSS 3.1 score is 8.8, but the vector is AV:L/PR:L, so exploitation requires existing local access and valid low-privilege credentials rather than a remote unauthenticated path; no public exploit or CISA KEV active exploitation is identified. Affected products include Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, and Cisco hardening releases are available via advisory cisco-sa-voice-hardening-twgbH9e3.
Cisco Unified CM and related Cisco UC products contain improper input validation that can let authenticated low-privilege attackers with network access affect confidentiality, integrity, and availability. Exploitation requires valid low-privilege credentials and reachability to the affected management/application interface, with no user interaction needed; the assessed CVSS 3.1 vector is 8.8 HIGH with high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
SQL injection in Cisco Unified CM and related Cisco collaboration products (Emergency Responder, Unified CM IM&P, Unified CM SME, and Unity Connection) allows authenticated remote attackers with low privileges to execute arbitrary SQL against the underlying database, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The flaw is network-reachable, low-complexity, and requires no user interaction, but exploitation requires a valid low-privilege account on an affected web or administrative interface. No public exploit was identified at time of analysis.
Cross-site scripting (XSS) in the web interfaces of Cisco Emergency Responder, Cisco Unified CM, Unified CM IM&P, Cisco Unity Connection, Prime Collaboration Deployment, and Unified CM SME lets unauthenticated, network-positioned attackers inject script that executes when a victim interacts with crafted content. The CVSS 9.3 vector reflects network reachability, low attack complexity, no attacker authentication, required victim interaction, scope change, and high confidentiality/integrity impact, so meaningful exploitation generally depends on luring an authenticated administrative user. No public exploit code or CISA KEV entry was identified at time of analysis, and Cisco's advisory describes hardening releases rather than a single emergency patch.
Authentication bypass in Cisco Unified CM and related Cisco collaboration products - Emergency Responder, Unified CM IM&P, Unity Connection, Prime Collaboration Deployment, and Unified CM SME - allows remote, unauthenticated attackers with low complexity and no user interaction to defeat authentication and potentially achieve full confidentiality, integrity, and availability impact (CVSS 9.8 Critical, CWE-287). The flaws were found in an internal Cisco review and fixed through hardening releases; no public exploit code or confirmed active exploitation was identified at time of analysis. Practical risk is tempered by exposure: these telephony and collaboration servers typically sit on internal or management networks rather than the public internet.
Cisco's batched voice-portfolio hardening release addresses several internally discovered injection-class defects (CWE-74) that affect Cisco Unified Communications Manager, Unified CM IM & Presence, Unified CM Session Management Edition, Unity Connection, Emergency Responder, and Prime Collaboration Deployment, and the vendor scores the bundled issue set at CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges and no user interaction, with high confidentiality, integrity, and availability impact. Because the advisory is a consolidated hardening bulletin rather than a per-defect writeup, the specific injectable parameter, protocol, or service is not disclosed, so the exact trigger cannot be derived from available data and real-world exposure depends on whether the management and application interfaces of these appliances are reachable from an attacker's network segment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and these are typically intranet-deployed enterprise voice appliances rather than internet-facing systems, which narrows practical attack surface to adjacent-network or intranet positions in most deployments.
Cisco voice and collaboration products - Unified Communications Manager, Unified CM IM & Presence, Emergency Responder and Unity Connection (with Prime Collaboration Deployment and Unified CM SME also named in the advisory) - contain a set of internally discovered flaws in the CWE-703 improper-handling-of-exceptional-conditions class that can be triggered over the network by an unauthenticated remote attacker with no user interaction, disrupting service availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) rates this as a denial-of-service condition only, with no confidentiality or integrity impact. The issues were found during Cisco's own hardening review rather than through external reporting, and no public exploit has been identified at time of analysis; the realistic exposure depends on whether the affected collaboration nodes are reachable from untrusted networks, since these services normally sit on internal management planes.
Path traversal in Cisco Unified CM and related collaboration appliances (Emergency Responder, Prime Collaboration Deployment, Unified CM IM&P/SME, and Unity Connection) lets an authenticated local user with low privileges supply crafted file paths to escape intended directories, yielding high confidentiality, integrity, and availability impact. The flaw is CWE-22 and is addressed by Cisco hardening releases from an internal security review; no public exploit was identified at time of analysis, and exploitation requires local access plus valid low-privilege credentials (CVSS AV:L/PR:L).
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or local session holder to gain high confidentiality, integrity, and availability impact, with scope change beyond the vulnerable component. The CVSS 3.1 score is 8.8, but the vector is AV:L/PR:L, so exploitation requires existing local access and valid low-privilege credentials rather than a remote unauthenticated path; no public exploit or CISA KEV active exploitation is identified. Affected products include Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, and Cisco hardening releases are available via advisory cisco-sa-voice-hardening-twgbH9e3.
Cisco Unified CM and related Cisco UC products contain improper input validation that can let authenticated low-privilege attackers with network access affect confidentiality, integrity, and availability. Exploitation requires valid low-privilege credentials and reachability to the affected management/application interface, with no user interaction needed; the assessed CVSS 3.1 vector is 8.8 HIGH with high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
SQL injection in Cisco Unified CM and related Cisco collaboration products (Emergency Responder, Unified CM IM&P, Unified CM SME, and Unity Connection) allows authenticated remote attackers with low privileges to execute arbitrary SQL against the underlying database, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The flaw is network-reachable, low-complexity, and requires no user interaction, but exploitation requires a valid low-privilege account on an affected web or administrative interface. No public exploit was identified at time of analysis.
Cross-site scripting (XSS) in the web interfaces of Cisco Emergency Responder, Cisco Unified CM, Unified CM IM&P, Cisco Unity Connection, Prime Collaboration Deployment, and Unified CM SME lets unauthenticated, network-positioned attackers inject script that executes when a victim interacts with crafted content. The CVSS 9.3 vector reflects network reachability, low attack complexity, no attacker authentication, required victim interaction, scope change, and high confidentiality/integrity impact, so meaningful exploitation generally depends on luring an authenticated administrative user. No public exploit code or CISA KEV entry was identified at time of analysis, and Cisco's advisory describes hardening releases rather than a single emergency patch.
Authentication bypass in Cisco Unified CM and related Cisco collaboration products - Emergency Responder, Unified CM IM&P, Unity Connection, Prime Collaboration Deployment, and Unified CM SME - allows remote, unauthenticated attackers with low complexity and no user interaction to defeat authentication and potentially achieve full confidentiality, integrity, and availability impact (CVSS 9.8 Critical, CWE-287). The flaws were found in an internal Cisco review and fixed through hardening releases; no public exploit code or confirmed active exploitation was identified at time of analysis. Practical risk is tempered by exposure: these telephony and collaboration servers typically sit on internal or management networks rather than the public internet.
Cisco's batched voice-portfolio hardening release addresses several internally discovered injection-class defects (CWE-74) that affect Cisco Unified Communications Manager, Unified CM IM & Presence, Unified CM Session Management Edition, Unity Connection, Emergency Responder, and Prime Collaboration Deployment, and the vendor scores the bundled issue set at CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges and no user interaction, with high confidentiality, integrity, and availability impact. Because the advisory is a consolidated hardening bulletin rather than a per-defect writeup, the specific injectable parameter, protocol, or service is not disclosed, so the exact trigger cannot be derived from available data and real-world exposure depends on whether the management and application interfaces of these appliances are reachable from an attacker's network segment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and these are typically intranet-deployed enterprise voice appliances rather than internet-facing systems, which narrows practical attack surface to adjacent-network or intranet positions in most deployments.