Multiple vulnerabilities exist in the web-based management interface of Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise because the interface fails to validate user-supplied input. An authenticated, remote attacker with administrative credentials can inject malicious code into specific pages and execute arbitrary scripts in the context of the interface, or access sensitive browser-based information.

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. No specific version information is provided, indicating that all product releases may be affected.

The CVSS score of 4.8 indicates low severity, while the EPSS score of less than 1% suggests a very low exploitation probability. The vulnerability is not listed in CISA's KEV catalog, further supporting its low likelihood of being actively exploited. An attacker must first obtain valid administrative credentials and then access the web management interface, making the primary attack vector a remote web-based management session with privileged accounts.