cisco-sa-ucm-timing-JVbHECOK: Cisco Unified Communications Products Timing Attack Vulnerability

Reference Links

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-timing-JVbHECOK (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

• CVE-2022-20752

Frequently Asked Questions

• What is the Cisco Unified Communications Products Timing Attack Vulnerability?

  The Cisco Unified Communications Products Timing Attack Vulnerability is a vulnerability in Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection that allows an unauthenticated, remote attacker to perform a timing attack.

• How does the Cisco Unified Communications Products Timing Attack Vulnerability occur?

  The Cisco Unified Communications Products Timing Attack Vulnerability occurs due to insufficient protection of sensitive information during cryptographic operations by affected Cisco products.

• What is the severity of the Cisco Unified Communications Products Timing Attack Vulnerability?

  The severity of the Cisco Unified Communications Products Timing Attack Vulnerability is medium, with a severity value of 5.3.

• Which Cisco products are affected by the Cisco Unified Communications Products Timing Attack Vulnerability?

  The Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection are affected by the Cisco Unified Communications Products Timing Attack Vulnerability.

• How can I mitigate the Cisco Unified Communications Products Timing Attack Vulnerability?

  To mitigate the Cisco Unified Communications Products Timing Attack Vulnerability, apply the recommended updates provided by Cisco for the affected products.