CVE-2008-1154 Auth bypass in n/a
Remote attackers can execute arbitrary code on Cisco Unified Communications DRF master servers due to missing authentication requirements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-1154?
CVE-2008-1154 is a critical authentication bypass vulnerability in Cisco Unified Communications Manager, published on 4 Apr 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products, including Unified Communications Manager (CUCM) 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the network, which allows remote attackers to execute arbitrary code via unspecified vectors.
Weakness: CWE-287
Which versions are affected by CVE-2008-1154?
It affects 4 products.
Products include Cisco Emergency Responder, Cisco Mobility Manager, Cisco Unified Communications Manager, Cisco Unified Presence.
How do I fix CVE-2008-1154?
No fix has been published for CVE-2008-1154 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2008-1154 being exploited?
There is no known exploitation of CVE-2008-1154 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Communications Manager
- CVE-2023-20101 Hardcoded credentials in Cisco Emergency Responder
- CVE-2017-12337 Hardcoded credentials in Cisco Voice Operating System
- CVE-2016-6468 Cross-site request forgery in Cisco Emergency Responder
- CVE-2023-20259 Denial of service in Cisco Emergency Responder
- CVE-2017-6779 Denial of service in Multiple Cisco Products unknown
Sources
Also known as GHSA-x77v-m6g8-v8pp.