RCE in Cisco Unified Communications Manager
CVE-2010-3039
/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.086 (94.5th percentile) — read the EPSS interpretation.
Affected products
- Cisco Unified_communications_manager — versions 6.1\(3b\)su1, 6.1\(4\)su1, 6.1\(4a\)su2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@cisco.com (Exploit, vdb-entry, x_refsource_BID)
- psirt@cisco.com (mailing-list, x_refsource_BUGTRAQ)
- psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)
- psirt@cisco.com (Exploit, x_refsource_MISC)
- psirt@cisco.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- psirt@cisco.com (mailing-list, Exploit, x_refsource_FULLDISC)
- psirt@cisco.com (vdb-entry, x_refsource_VUPEN, Vendor Advisory)