CVE-2006-5277: Cisco Unified Callmanager

High severity, CVSS 9.3. EPSS: 9.6% chance of exploitation in the next 30 days.

Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via a crafted packet that triggers a heap-based buffer overflow.

Affected products

• Cisco Unified Callmanager: from 3.3, up to and including 3.3\(5\)sr2; from 4.1, up to and including 4.1\(3\)sr4; from 4.2, up to and including 4.2\(3\)sr1; version 5.0 only
• Cisco Unified Communications Manager: from 4.3, up to and including 4.3\(1\); from 5.1, up to and including 5.1\(1\)

Published 2007-07-15. Last modified 2026-06-16.