CVE-2013-7030 — HIGH (7.3) — White Hats Nepal

Vulnerability Description

The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discovering a cleartext UseUserCredential field in an SPDefault.cnf.xml file. NOTE: the vendor reportedly disputes the significance of this report, stating that this is an expected default behavior, and that the product's documentation describes use of the TFTP Encrypted Config option in addressing this issue

CVSS Score

7.3

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Cisco	Unified Communications Manager	All versions

Related Weaknesses (CWE)

CWE-310

References

FAQ

What is CVE-2013-7030?

CVE-2013-7030 is a vulnerability with a CVSS score of 7.3 (HIGH). The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demonstrated by discover...

How severe is CVE-2013-7030?

CVE-2013-7030 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-7030?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Unified Communications Manager.