CVE-2021-1362: high-severity vulnerability in Cisco Unity Connection
Cisco Unified Communications Products Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 2.8%
A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, Cisco Unity Connection, and Cisco Prime License Manager could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Unity ConnectionRelated CVEs — Cisco Unity Connection
In the same product, most dangerous first.
CVE-2026-20045HIGHCisco Unified Communications Products Remote Code Execution VulnerabilityEPSS 4.5%KEVCVE-2024-20253CRITICALCVE-2024-20253EPSS 2.4%CVE-2018-15396—Cisco Unity Connection File Upload Denial of Service VulnerabilityEPSS 1.8%CVE-2020-3130MEDIUMCisco Unity Connection Directory Traversal VulnerabilityEPSS 1.8%CVE-2024-20272HIGHCVE-2024-20272EPSS 1.6%CVE-2021-34701MEDIUMCisco Unified Communications Products Path Traversal VulnerabilityEPSS 1.6%