CVE-2008-0027: Cisco Unified Callmanager

High severity, CVSS 10.0. EPSS: 57.1% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and CallManager 4.0 and 4.1 before 4.1(3)SR5c, allows remote attackers to cause a denial of service or execute arbitrary code via a long request.

Affected products

• Cisco Unified Callmanager: version 4.0 only; version 4.1 only; version 4.1(3)sr4 only; version 4.1(3)sr5 only; version 4.1(3)sr5b only
• Cisco Unified Communications Manager: version 4.2 only; version 4.2.3sr2 only; version 4.2.3sr2b only; version 4.3 only

Published 2008-01-17. Last modified 2026-06-16.