cisco-sa-20181107-cue: Cisco Unity Express Arbitrary Command Execution Vulnerability
First published: Wed Nov 07 2018(Updated: )
A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue
Credit: Joshua Graham TSS
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unity Express Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20181107-cue?
The severity of cisco-sa-20181107-cue is critical due to the potential for unauthenticated remote command execution.
How do I fix cisco-sa-20181107-cue?
To fix cisco-sa-20181107-cue, update your Cisco Unity Express software to the latest version that addresses this vulnerability.
Who is affected by cisco-sa-20181107-cue?
Cisco Unity Express users are affected by cisco-sa-20181107-cue if they are running vulnerable software versions.
What is the impact of cisco-sa-20181107-cue?
The impact of cisco-sa-20181107-cue is the potential unauthorized execution of arbitrary shell commands with root privileges.
Can cisco-sa-20181107-cue be exploited remotely?
Yes, cisco-sa-20181107-cue can be exploited remotely by an unauthenticated attacker.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/remedy
- agent/severity
- agent/title
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unity express software