CVE-2026-20081

{"id": "CVE-2026-20081", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20081", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:08.016233Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)SU1"}, {"status": "affected", "version": "12.5(1)SU2"}, {"status": "affected", "version": "12.5(1)SU3"}, {"status": "affected", "version": "12.5(1)SU4"}, {"status": "affected", "version": "14"}, {"status": "affected", "version": "12.5(1)SU5"}, {"status": "affected", "version": "14SU1"}, {"status": "affected", "version": "12.5(1)SU6"}, {"status": "affected", "version": "14SU2"}, {"status": "affected", "version": "12.5(1)SU7"}, {"status": "affected", "version": "14SU3"}, {"status": "affected", "version": "12.5(1)SU8"}, {"status": "affected", "version": "14SU3a"}, {"status": "affected", "version": "12.5(1)SU8a"}, {"status": "affected", "version": "15"}, {"status": "affected", "version": "15SU1"}, {"status": "affected", "version": "14SU4"}, {"status": "affected", "version": "12.5(1)SU9"}, {"status": "affected", "version": "15SU2"}, {"status": "affected", "version": "15SU3"}, {"status": "affected", "version": "14SU5"}], "defaultStatus": "unknown"}]}], "published": "2026-04-15T17:17:01.783", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades en Cisco Unity Connection podr\u00edan permitir a un atacante remoto autenticado descargar archivos arbitrarios de un sistema afectado. Para explotar estas vulnerabilidades, el atacante debe tener credenciales administrativas v\u00e1lidas.\n\nEstas vulnerabilidades se deben a una sanitizaci\u00f3n inadecuada de la entrada del usuario en la interfaz de gesti\u00f3n basada en web. Un atacante podr\u00eda explotar estas vulnerabilidades enviando una solicitud HTTPS manipulada. Un exploit exitoso podr\u00eda permitir al atacante descargar archivos arbitrarios de un sistema afectado."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DAF417F-F480-4A4D-845B-8338776FF253", "versionEndIncluding": "12.5"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "774C01A1-9328-45E8-9BDD-470A10BC3C2A"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B70BACC-B771-4049-8A55-3B277913DEEF"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D09F3655-B513-48F6-82A8-F0F946C52D25"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E51AF0FF-016D-4F20-8F88-0E70D18C375C"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97CC6719-1A7F-48BA-8014-802E235ED80D"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C9412EC-282C-4926-83F8-932E24E0FC22"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37EFE547-7D3C-4D71-8D46-2C5734B9D64B"}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}