CVE-2013-7030: Cisco Unified Communications Manager

Record summary

CVE-2013-7030 has a selected CVSS score of 7.3 (high); EIP currently links 1 catalogued exploit.

Description

The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discovering a cleartext UseUserCredential field in an SPDefault.cnf.xml file. NOTE: the vendor reportedly disputes the significance of this report, stating that this is an expected default behavior, and that the product's documentation describes use of the TFTP Encrypted Config option in addressing this issue

Description source: CVE List

Exploitation context

Available material

Catalogued exploits: 1

CISA SSVC decision

ExploitationPoC

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 29, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
cisco_unified_communications_manager Browse cisco / cisco_unified_communications_manager Default status: unknown	CVE List	Version range not supplied	affected

Proofs of concept

Catalogued exploits

ExploitDBCisco Unified Communications Manager - TFTP ServiceExploitDB exploitby daniel svartmanNot analyzed1 file

ExploitDB

PoC details

References

100916vdb entry

http://osvdb.org/100916

30237exploit

http://www.exploit-db.com/exploits/30237

cisco-ucm-tftp-info-disc(89649)vdb entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/89649

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2013-7030