Cisco fixes a critical flaw in Unified CCMP and Unified CCDM

Cisco fixed a critical privilege escalation vulnerability, tracked as CVE-2022-20658, in Unified CCMP and Unified CCDM.

Cisco released security patches to address a critical privilege escalation vulnerability, tracked as CVE-2022-20658, in Unified Contact Center Management Portal (Unified CCMP) and Unified Contact Center Domain Manager (Unified CCDM). A remote attacker could exploit the flaw to elevate privileges to administrator.

The vulnerability resides in the web-based management interface of the Cisco Unified CCMP and Cisco Unified CCDM products.

The CVE-2022-20658 received a CVSS score of 9.6, the flaw is caused by the lack of server-side validation of user permissions. An attacker can trigger the flaw by sending a crafted HTTP request to a vulnerable system.

“This vulnerability is due to the lack of server-side validation of user permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to a vulnerable system. A successful exploit could allow the attacker to create Administrator accounts. With these accounts, the attacker could access and modify telephony and user resources across all the Unified platforms that are associated to the vulnerable Cisco Unified CCMP.” reads the advisory published by Cisco.“To successfully exploit this vulnerability, an attacker would need valid Advanced User credentials.”

The flaw could be only exploited by an attacker that has valid Advanced User credentials.

The vulnerability was addressed with the release of Unified CCMP/ Unified CCDM versions 11.6.1 ES17, 12.0.1 ES5, and 12.5.1 ES5. Version 12.6.1 is not affected.

The good news is that the IT giant is not aware of attacks in the wild exploiting this vulnerability.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, privilege escalation)

---