CVE-2013-4869
Published Jul 18, 2013
Last updated 4 years ago
Overview
- Description
- Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1(2) use the same CTI and database-encryption key across different customers' installations, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key, aka Bug IDs CSCsc69187 and CSCui01756. NOTE: the vendor has provided a statement that the "hard-coded static encryption key is considered a hardening issue rather than a vulnerability, and as such, has a CVSS score of 0/0."
- Source
- cve@mitre.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 0
- Impact score
- 0
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:N
Weaknesses
- nvd@nist.gov
- CWE-522
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F97E2E73-108D-42E0-B604-2992D6BB5F1D",
"versionEndIncluding": "9.1\\(2\\)",
"versionStartIncluding": "7.1\\(1\\)"
}
],
"operator": "OR"
}
]
}
]