A vulnerability in the web-based management interface of Cisco Unity Connection permits an unauthenticated remote attacker to manipulate HTTP request parameters so that a user is redirected to a malicious web page. This open redirect flaw enables phishing or credential-stealing campaigns by piggybacking on legitimate user traffic. The weakness is rooted in unvalidated input handling, classifying it as a CWE-601 Open Redirect condition.

Cisco Unity Connection – a unified communications platform. No specific affected versions are listed in the advisory, so the vulnerability may exist in multiple releases of the web management interface.

The CVSS base score of 4.7 indicates moderate risk, and the lack of an EPSS score means the likelihood of exploitation cannot be quantified from publicly available data. The vulnerability is not catalogued in the CISA KEV list. Exposing the management interface to the internet or allowing users to follow forged links provides a straightforward attack vector, enabling the attacker to redirect users to malicious sites and facilitate phishing or other social-engineering attacks.