CVE-2021-1226 Cisco Unified Communications Products Information Disclosure Vulnerability
Authenticated attackers can view unencrypted credentials in audit logs, potentially allowing them to manage network devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-1226?
CVE-2021-1226 is a medium-severity vulnerability in Cisco Unified Communications Manager, published on 13 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, Cisco Emergency Responder, and Cisco Prime License Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. The vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices.
Weakness: CWE-532
Which versions are affected by CVE-2021-1226?
It affects 5 products.
Products include Cisco Emergency Responder, Cisco Prime License Manager, Cisco Unified Communications Manager, Cisco Unified Communications Manager Im \& Presence Service, Cisco Unity Connection.
How do I fix CVE-2021-1226?
No fix has been published for CVE-2021-1226 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-1226 being exploited?
There is no known exploitation of CVE-2021-1226 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Communications Manager
Sources
Also known as GHSA-mg6r-7gcg-995g.