Cisco Emergency Responder vulnerabilities

27 CVEs affecting Cisco Emergency Responder, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-20352, published 2024-04-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2005-0356, published 2005-05-31. Medium severity, CVSS 5.0. EPSS: 82.8% chance of exploitation in the next 30 days. Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a…
CVE-2017-12337, published 2017-11-16. Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain…
CVE-2008-1154, published 2008-04-04. High severity, CVSS 10.0. EPSS: 5.1% chance of exploitation in the next 30 days. The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products, including Unified Communications Manager (CUCM) 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency…
CVE-2004-1760, published 2004-01-21. High severity, CVSS 10.0. EPSS: 3.8% chance of exploitation in the next 30 days. The default installation of Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, does not require authentication, which allows remote attackers to gain…
CVE-2016-9208, published 2016-12-14. Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days. A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files…
CVE-2023-20101, published 2023-10-04. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot…
CVE-2004-1759, published 2004-01-21. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. Cisco voice products, when running the IBM Director Agent on IBM servers before OS 2000.2.6, allows remote attackers to cause a denial of service (CPU consumption) via arbitrary packets to TCP port…
CVE-2015-6406, published 2015-12-13. Medium severity, CVSS 4.0. EPSS: 2.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Tools menu in Cisco Emergency Responder 10.5(1.10000.5) allows remote authenticated users to write to arbitrary files via a crafted filename, aka Bug ID…
CVE-2017-6779, published 2018-06-07. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to…

Latest

CVE-2024-20352, published 2024-04-03. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an…
CVE-2024-20347, published 2024-04-03. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow the attacker to perform arbitrary actions on an affected…
CVE-2023-20259, published 2023-10-04. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the…
CVE-2023-20266, published 2023-08-30. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity…
CVE-2021-1226, published 2021-01-13. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &…
CVE-2019-16025, published 2020-09-23. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based…
CVE-2018-15403, published 2018-10-05. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could…