Product:
Cisco Unified Communications Manager
Summary
A vulnerability in Cisco Unified Communications Manager and related products could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability arises from improper validation of user-supplied input in HTTP requests. An attacker could exploit this by sending crafted HTTP requests to the web-based management interface, potentially gaining user-level access and elevating privileges to root.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.2 | CVE-2026-20045 |
Exploitation
To exploit this vulnerability, an attacker would need to send a series of specially crafted HTTP requests to the web-based management interface of an affected device. If successful, the attacker could gain user-level access to the operating system and then escalate privileges to root, allowing for full control over the device.
Affected Products
- Cisco Unified Communications Manager: A core product for managing voice and video communications.
- Cisco Unified Communications Manager Session Management Edition: A variant designed for session management in communications.
- Cisco Unified Communications Manager IM & Presence Service: Provides instant messaging and presence capabilities.
- Cisco Unity Connection: A voicemail and unified messaging solution.
- Cisco Webex Calling Dedicated Instance: A cloud-based calling solution for businesses.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Cisco for the affected products. Additionally, restricting access to the web-based management interface and implementing network security measures can help prevent unauthorized access.