CVE-2013-4869 Hardcoded credentials in n/a

None 0.0 Published 18 Jul 2013 Updated 6 Aug 2024

Attackers can bypass cryptographic protections in Cisco Unified Communications Manager using a shared static encryption key to access sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2013-4869?

CVE-2013-4869 is a vulnerability in Cisco Unified Communications Manager, published on 18 Jul 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1(2) use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key, aka Bug IDs CSCsc69187 and CSCui01756. NOTE: the vendor has provided a statement that the "hard-coded static encryption key is considered a hardening issue rather than a vulnerability, and as such, has a CVSS score of 0/0."

Weakness: CWE-522

Which versions are affected by CVE-2013-4869?

It affects 1 product.

Products include Cisco Unified Communications Manager.

How do I fix CVE-2013-4869?

No fix has been published for CVE-2013-4869 yet. Limit exposure of the affected software until one is available.

Is CVE-2013-4869 being exploited?

There is no known exploitation of CVE-2013-4869 in the wild and no public exploit code.

All Cisco Unified Communications Manager vulnerabilities

Sources

Also known as GHSA-563c-77qf-c6mg.