Information disclosure in Cisco Emergency Responder
CVE-2021-1226
A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, Cisco Emergency Responder, and Cisco Prime License Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. The vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices.
EPSS: 0.009 (57.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Cisco Emergency Responder — versions n/a
- Cisco Emergency_responder — versions 10.5(2), 11.5\(1\), 10.5\(2\)
- Cisco Prime_license_manager — versions 10.5(2), 10.5\(2\)
- Cisco Unified_communications_manager — versions 10.5(2), 10.5\(2\)
- Cisco Unified_communications_manager_im_\&_presence_service — versions 10.5(2), 10.5\(2\), 12.0(1)
- Cisco Unity_connection — versions 10.5(2), 10.5\(2\)
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-1226?
- CVE-2021-1226 is a medium-severity vulnerability in Cisco Emergency Responder, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.3/10. Published 2021-01-13.
- How severe is CVE-2021-1226?
- Medium severity. CVSS v3 base score is 4.3 out of 10.