Technical impact
This vulnerability allows an authenticated user with administrative privileges to download any file from a Cisco Unity Connection server. The flaw arises from inadequate sanitization of input to the web‑based administration interface, enabling a path traversal attack. An attacker who can send a crafted HTTPS request can cause the server to return the contents of arbitrary files, potentially exposing sensitive configuration or credential data.
Affected Systems
The flaw affects Cisco Unity Connection software. No specific version range is provided; any installation that has not applied the latest security updates may be vulnerable.
Risk and Exploitability
The vulnerability carries a CVSS base score of 6.5, indicating a moderate impact. Exploitation requires valid administrative credentials and a remote HTTPS connection to the management interface. No exploit probability is available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that it has not yet been widely exploited. However, the ability to download arbitrary files poses significant confidentiality risks if administrative access is compromised.
