CVE-2021-1406 Cisco Unified Communications Manager Information Disclosure Vulnerability

Medium 4.9 Published 8 Apr 2021 Updated 8 Nov 2024

Authenticated attackers with elevated privileges can access sensitive hashed credentials via downloadable files in Cisco Unified Communications Manager.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-1406?

CVE-2021-1406 is a medium-severity vulnerability in Cisco Unified Communications Manager, published on 8 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to improper inclusion of sensitive information in downloadable files. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to obtain hashed credentials of system users. To exploit this vulnerability an attacker would need to have valid user credentials with elevated privileges.

Weakness: CWE-200, CWE-538

Which versions are affected by CVE-2021-1406?

It affects 1 product.

Products include Cisco Unified Communications Manager.

How do I fix CVE-2021-1406?

No fix has been published for CVE-2021-1406 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-1406 being exploited?

There is no known exploitation of CVE-2021-1406 in the wild and no public exploit code.

All Cisco Unified Communications Manager vulnerabilities

Sources

Also known as GHSA-495g-cj2m-hr56.