CVE-2008-0026: Cisco Unified Callmanager

Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL commands via the key parameter to the (1) admin and (2) user interface pages.

Affected products

• Cisco Unified Callmanager: version 5.0 only; version 5.0(1) only; version 5.0(2) only; version 5.0(3) only; version 5.0(3a) only; version 5.0(4) only; …
• Cisco Unified Communications Manager: version 5.0 only; version 5.0_1 only; version 5.0_2 only; version 5.0_3 only; version 5.0_3a only; version 5.0_4 only; …

Published 2008-02-14. Last modified 2026-06-16.