Vulnerability in Cisco Unified Communications Manager
CVE-2013-7030
The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discovering a cleartext UseUserCredential field in an SPDefault.cnf.xml file. NOTE: the vendor reportedly disputes the significance of this report, stating that this is an expected default behavior, and that the product's documentation describes use of the TFTP Encrypted Config option in addressing this issue
Vulnerability class: POODLE (CVE-2014-3566)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.052 (92.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.052 · newest: 0.052 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.exploit-db.com/exploits/30237/ (Exploit, VDB Entry, exploit)
- exchange.xforce.ibmcloud.com/vulnerabilities/89649 (vdb-entry)
- osvdb.org/100916 (vdb-entry)
Frequently asked questions
- What is CVE-2013-7030?
- CVE-2013-7030 is a high-severity vulnerability in Cisco Unified Communications Manager, classified under Cryptographic Issues. CVSS score: 7.3/10. Published 2013-12-12.
- How severe is CVE-2013-7030?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2013-7030 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.