CVE-2019-1837 Cisco Unified Communications Manager Denial of Service Vulnerability
Unauthenticated remote attackers can cause a denial of service on the management GUI by sending crafted requests to the UDS API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1837?
CVE-2019-1837 is a medium-severity denial of service vulnerability in Cisco Unified Communications Manager, published on 18 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the User Data Services (UDS) API of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the management GUI. The vulnerability is due to improper validation of input parameters in the UDS API requests. An attacker could exploit this vulnerability by sending a crafted request to the UDS API of an affected device. A successful exploit could allow the attacker to make the A Cisco DB service quit unexpectedly, preventing admin access to the Unified CM management GUI. Manual intervention may be required to restore normal operation. Software versions 10.5, 11.5, 12.0, 12.5 are affected.
Which versions are affected by CVE-2019-1837?
It affects 1 product.
Products include Cisco Unified Communications Manager.
How do I fix CVE-2019-1837?
No fix has been published for CVE-2019-1837 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-1837 being exploited?
There is no known exploitation of CVE-2019-1837 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Communications Manager
- CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery (SSRF)
- CVE-2026-20045 Cisco Unified Communications Products Code Injection
- CVE-2025-20309 Cisco Unified Communications Manager Static SSH Credentials Vulnerability
- CVE-2011-1643 Information disclosure in n/a
- CVE-2024-20253 Deserialization in Cisco Packaged Contact Center Enterprise
Sources
Also known as GHSA-gqfv-p773-g6r7.