CVE-2026-20034

{"id": "CVE-2026-20034", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20034", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)SU1"}, {"status": "affected", "version": "12.5(1)SU2"}, {"status": "affected", "version": "12.5(1)SU3"}, {"status": "affected", "version": "12.5(1)SU4"}, {"status": "affected", "version": "14"}, {"status": "affected", "version": "12.5(1)SU5"}, {"status": "affected", "version": "14SU1"}, {"status": "affected", "version": "12.5(1)SU6"}, {"status": "affected", "version": "14SU2"}, {"status": "affected", "version": "12.5(1)SU7"}, {"status": "affected", "version": "14SU3"}, {"status": "affected", "version": "12.5(1)SU8"}, {"status": "affected", "version": "14SU3a"}, {"status": "affected", "version": "12.5(1)SU8a"}, {"status": "affected", "version": "15"}, {"status": "affected", "version": "15SU1"}, {"status": "affected", "version": "14SU4"}, {"status": "affected", "version": "12.5(1)SU9"}, {"status": "affected", "version": "15SU2"}, {"status": "affected", "version": "15SU3"}], "defaultStatus": "unknown"}]}], "published": "2026-05-06T17:16:20.093", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASy", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-35"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de gesti\u00f3n basada en web de Cisco Unity Connection podr\u00eda permitir a un atacante remoto autenticado ejecutar c\u00f3digo arbitrario en un dispositivo afectado.\n\nEsta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario. Un atacante podr\u00eda explotar esta vulnerabilidad al enviar una solicitud de API manipulada. Un exploit exitoso podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario como root, lo que posiblemente resultar\u00eda en el compromiso completo de un dispositivo objetivo. Para explotar esta vulnerabilidad, el atacante debe tener credenciales de usuario v\u00e1lidas en el dispositivo afectado."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6313AB2B-8CBB-48FF-BCBF-B24DE98855EF", "versionEndExcluding": "14.0"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "774C01A1-9328-45E8-9BDD-470A10BC3C2A"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D09F3655-B513-48F6-82A8-F0F946C52D25"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97CC6719-1A7F-48BA-8014-802E235ED80D"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C9412EC-282C-4926-83F8-932E24E0FC22"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37EFE547-7D3C-4D71-8D46-2C5734B9D64B"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}