A flaw in the web user interface of Cisco Unity Connection Web Inbox allows an unauthenticated remote attacker to send specially crafted HTTP requests. Improper input validation permits the attacker to instruct the affected device to issue arbitrary network requests from its own network stack. This enables the attacker to probe internal resources, exfiltrate data, or pivot to other systems without first authenticating to Cisco Unity Connection.

The vulnerability targets Cisco Unity Connection, specifically the Web Inbox component of the Cisco Unity Connection web UI. No specific affected version numbers are listed in the advisory, so all deployed instances of the Web Inbox that have not been patched are potentially susceptible.

The CVSS score of 7.2 indicates a moderate to high severity, and the absence of an EPSS score means the current exploitation probability is unknown, though the lack of an authentication requirement suggests a low complexity attack path. The advisory does not list this vulnerability in the CISA KEV catalog, so no known exploit is currently documented. Based on the description, the likely attack vector is remote network access to the web UI, with the attacker able to direct any outbound requests from the device to internal or external hosts.