Cisco Unity Connection SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the web-based management interface of Cisco Unity Connection. This vulnerability allows an authenticated, remote attacker to execute SQL injection attacks on affected devices. The issue arises from inadequate validation of user-supplied input, enabling attackers to send crafted HTTP(S) requests that could be exploited to access unauthorized data on the device.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to perform SQL injection attacks, potentially leading to unauthorized data access on the affected device.

Remediation

Cisco has released software updates to address this vulnerability. Users are advised to upgrade to the fixed releases mentioned in the Cisco Security Advisory.