Cisco Unity Express vulnerabilities

5 CVEs affecting Cisco Unity Express, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-15986, published 2019-11-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-15381, published 2018-11-08. Critical severity, CVSS 9.8. EPSS: 87.3% chance of exploitation in the next 30 days. A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The…
CVE-2005-4794, published 2005-12-31. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. Cisco IP Phones 7902/7905/7912, ATA 186/188, Unity Express, ACNS, and Subscriber Edge Services Manager (SESM) allows remote attackers to cause a denial of service (crash or instability) via a…
CVE-2006-2166, published 2006-05-04. Low severity, CVSS 2.1. EPSS: 1.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the HTTP management interface in Cisco Unity Express (CUE) 2.2(2) and earlier, when running on any CUE Advanced Integration Module (AIM) or Network Module (NM), allows…
CVE-2013-1120, published 2013-02-06. Medium severity, CVSS 6.8. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown…
CVE-2019-15986, published 2019-11-26. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. To exploit this vulnerability, an…