cisco-sa-vos-command-inject-65s2UCYy: Cisco Unified Communications Products Command Injection Vulnerability
A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user.This vulnerability is due to improper validation of user-supplied command arguments. An attacker could exploit this vulnerability by executing crafted commands on the CLI of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vos-command-inject-65s2UCYy
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-vos-command-inject-65s2UCYy?
The severity of cisco-sa-vos-command-inject-65s2UCYy is rated as critical due to its potential to allow root command execution.
How do I fix cisco-sa-vos-command-inject-65s2UCYy?
To fix cisco-sa-vos-command-inject-65s2UCYy, update your affected Cisco Unified Communications products to the latest patched version.
Who is affected by cisco-sa-vos-command-inject-65s2UCYy?
Organizations using Cisco Unified Communications products, specifically those with vulnerable configurations, are at risk from cisco-sa-vos-command-inject-65s2UCYy.
What are the consequences of cisco-sa-vos-command-inject-65s2UCYy?
Exploitation of cisco-sa-vos-command-inject-65s2UCYy could allow attackers to execute arbitrary commands as the root user, leading to complete system compromise.
Is authentication required for exploiting cisco-sa-vos-command-inject-65s2UCYy?
Yes, cisco-sa-vos-command-inject-65s2UCYy requires an authenticated, local attacker to exploit the vulnerability.