CVE-2020-3177: Cisco Unified Communications Manager Path Traversal Vulnerability
A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the TAPS interface of the affected device. An attacker could exploit this vulnerability by sending a crafted request to the TAPS interface. A successful exploit could allow the attacker to read arbitrary files in the system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-3177?
CVE-2020-3177 is a vulnerability in Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) that allows a remote attacker to conduct directory traversal attacks on an affected device.
How severe is CVE-2020-3177?
CVE-2020-3177 has a severity rating of 7.5 out of 10 (high severity).
Which Cisco products are affected by CVE-2020-3177?
Cisco Unified Communications Manager versions 10.5(2.10000.5), 11.5(1.10000.6), 12.0(1.10000.10), and 12.5(1.10000.22), as well as Cisco Unified Contact Center Express version 12.0(1), are affected by CVE-2020-3177.
How can an attacker exploit CVE-2020-3177?
An attacker can exploit CVE-2020-3177 by sending malicious requests to the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) or Cisco Unified Communications Manager Session Management Edition (SME) to perform directory traversal attacks.
Where can I find more information about CVE-2020-3177?
You can find more information about CVE-2020-3177 on the Cisco Security Advisory page: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-taps-path-trav-pfsFO93r