Cisco Unified Communications Products Privilege Escalation Vulnerability (Cisco Cisco Emergency Responder)
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 4 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Deferred
Description
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
Faiblesses (CWE)
- CWE-268 — Privilege Chaining
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N | cisco |
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N | NVD · psirt@cisco.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-16023
- GCVE · GCVE-0-2025-20112
Produits affectés
| Produit | Versions |
|---|---|
| Cisco · Cisco Emergency Responder | affected 12.5(1a) ; affected 12.5(1)SU1 ; affected 12.5(1) ; affected 12.5(1)SU2 ; affected 12.5(1)SU3 ; affected 12.5(1)SU4 |
| Cisco · Cisco Finesse | affected 11.0(1)ES_Rollback ; affected 10.5(1)ES4 ; affected 11.6(1)ES3 ; affected 11.0(1)ES2 ; affected 12.0(1)ES2 ; affected 10.5(1)ES3 |
| Cisco · Cisco Prime Collaboration Deployment | affected 11.5(1) ; affected 11.0(1a) ; affected 11.5(1)SU1 ; affected 10.5(3) ; affected 12.6(1) ; affected 11.0(1) |
| Cisco · Cisco SocialMiner | affected 12.5(1)ES01 ; affected 10.5(1) ; affected 11.6(1) ; affected 10.6(1) ; affected 12.0(1)ES04 ; affected 10.6(2) |
| Cisco · Cisco Unified Communications Manager | affected 12.5(1)SU2 ; affected 12.5(1)SU1 ; affected 12.5(1) ; affected 12.5(1)SU3 ; affected 12.5(1)SU4 ; affected 14 |
| Cisco · Cisco Unified Communications Manager IM and Presence Service | affected 12.5(1) ; affected 12.5(1)SU1 ; affected 12.5(1)SU2 ; affected 12.5(1)SU3 ; affected 12.5(1)SU4 ; affected 14 |
| Cisco · Cisco Unified Contact Center Express | affected 10.5(1)SU1 ; affected 10.6(1) ; affected 11.6(1) ; affected 10.6(1)SU1 ; affected 10.6(1)SU3 ; affected 11.6(2) |
| Cisco · Cisco Unified Intelligence Center | affected 11.6(1) ; affected 10.5(1) ; affected 11.0(1) ; affected 11.5(1) ; affected 12.0(1) ; affected 12.5(1) |
| Cisco · Cisco Unity Connection | affected 12.5(1) ; affected 12.5(1)SU1 ; affected 12.5(1)SU2 ; affected 12.5(1)SU3 ; affected 12.5(1)SU4 ; affected 14 |
| Cisco · Cisco Virtualized Voice Browser | affected 11.0(1) ; affected 11.6(1)_ES84 ; affected 11.5(1)_ES54 ; affected 11.5(1)_ES27 ; affected 11.5(1) ; affected 11.5(1)ES36 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |