Cisco Unified Callmanager vulnerabilities

18 CVEs affecting Cisco Unified Callmanager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-0680, published 2015-03-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0027, published 2008-01-17. High severity, CVSS 10.0. EPSS: 57.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and…
CVE-2006-5277, published 2007-07-15. High severity, CVSS 9.3. EPSS: 9.6% chance of exploitation in the next 30 days. Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to…
CVE-2006-5278, published 2007-07-15. High severity, CVSS 10.0. EPSS: 8.9% chance of exploitation in the next 30 days. Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote…
CVE-2007-5538, published 2007-10-18. High severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days. Buffer overflow in the Centralized TFTP File Locator Service in Cisco Unified Communications Manager (CUCM, formerly CallManager) 5.1 before 5.1(3), and Unified CallManager 5.0, allows remote…
CVE-2006-3594, published 2006-07-18. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. Buffer overflow in Cisco Unified CallManager (CUCM) 5.0(1) through 5.0(3a) allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542.
CVE-2008-3800, published 2008-09-26. High severity, CVSS 7.1. EPSS: 3.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows…
CVE-2008-3801, published 2008-09-26. High severity, CVSS 7.1. EPSS: 3.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows…
CVE-2006-5553, published 2006-10-26. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as used by Unified CallManager (CUCM) and Unified Presence Server (CUPS), allows remote attackers to cause a denial…
CVE-2009-2864, published 2009-09-28. High severity, CVSS 7.8. EPSS: 2.9% chance of exploitation in the next 30 days. Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7.1.x before 7.1(2) allows remote attackers to cause a denial…
CVE-2007-1833, published 2007-04-03. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. The Skinny Call Control Protocol (SCCP) implementation in Cisco Unified CallManager (CUCM) 3.3 before 3.3(5)SR2a, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3)SR1, and 5.0 before 5.0(4a)SU1 allows remote…

Latest

CVE-2015-0680, published 2015-03-28. Medium severity, CVSS 4.0. EPSS: 1.3% chance of exploitation in the next 30 days. Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID…
CVE-2008-1744, published 2008-05-16. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to…
CVE-2008-0026, published 2008-02-14. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote authenticated users to execute arbitrary SQL…
CVE-2007-5537, published 2007-10-18. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. Cisco Unified Communications Manager (CUCM, formerly CallManager) 5.1 before 5.1(2), and Unified CallManager 5.0, allow remote attackers to cause a denial of service (kernel panic) via a flood of SIP…