CVEvulnerability

CVE-2021-1406

4.9 MEDIUM Published 2021-04-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-04-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-538

Description

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.

Affected configurations

• cisco unified communications manager 10.5\(2\) • cisco unified communications manager 10.5\(2\)su1 • cisco unified communications manager 10.5\(2\)su2 • cisco unified communications manager 10.5\(2\)su2a • cisco unified communications manager 10.5\(2\)su3 • cisco unified communications manager 10.5\(2\)su3a • cisco unified communications manager 10.5\(2\)su4 • cisco unified communications manager 10.5\(2\)su4a • cisco unified communications manager 10.5\(2\)su5 • cisco unified communications manager 10.5\(2\)su6 • cisco unified communications manager 10.5\(2\)su6a • cisco unified communications manager 10.5\(2\)su7 • cisco unified communications manager 10.5\(2\)su8 • cisco unified communications manager 10.5\(2\)su9 • cisco unified communications manager 10.5\(2\)su10 • cisco unified communications manager 11.5\(1\) • cisco unified communications manager 11.5\(1\)su1 • cisco unified communications manager 11.5\(1\)su2 • cisco unified communications manager 11.5\(1\)su3 • cisco unified communications manager 11.5\(1\)su4 • cisco unified communications manager 11.5\(1\)su5 • cisco unified communications manager 11.5\(1\)su7 • cisco unified communications manager 11.5\(1\)su8 • cisco unified communications manager 11.5\(1\)su9 • cisco unified communications manager 12.0\(1\) • cisco unified communications manager 12.5\(1\) • cisco unified communications manager 12.5\(1\)su1 • cisco unified communications manager 12.5\(1\)su2 • cisco unified communications manager 12.5\(1\)su3 • cisco unified communications manager 12.5\(1\)su4 • cisco unified communications manager 12.5\(1\)su5

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory weakness

References