// For flags

CVE-2021-1562

Cisco BroadWorks Application Server Information Disclosure Vulnerability

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability in the XSI-Actions interface of Cisco BroadWorks Application Server could allow an authenticated, remote attacker to access sensitive information on an affected system. This vulnerability is due to improper input validation and authorization of specific commands that a user can execute within the XSI-Actions interface. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a specific set of commands. A successful exploit could allow the attacker to join a Call Center instance and have calls that they do not have permissions to access distributed to them from the Call Center queue. At the time of publication, Cisco had not released updates that address this vulnerability for Cisco BroadWorks Application Server. However, firmware patches are available.

Una vulnerabilidad en la interfaz XSI-Actions de Cisco BroadWorks Application Server, podría permitir a un atacante remoto autenticado acceder a información confidencial en un sistema afectado. Esta vulnerabilidad se presenta debido a una comprobación inapropiada de entrada y autorización de comandos específicos que un usuario puede ejecutar dentro de la interfaz XSI-Actions. Un atacante podría explotar esta vulnerabilidad autenticándose en un dispositivo afectado y emitiendo un conjunto específico de comandos. Una explotación con éxito podría permitir al atacante unirse a una instancia de Call Center y hacer que se le distribuyan llamadas a las que no tiene permisos para acceder desde la cola de Call Center. En el momento de la publicación, Cisco no había publicado actualizaciones que abordaran esta vulnerabilidad para Cisco BroadWorks Application Server. Sin embargo, se encuentran parches de firmware disponibles

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2020-11-13 CVE Reserved
  • 2021-07-08 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-11-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Broadworks Application Server
Search vendor "Cisco" for product "Broadworks Application Server"
 >= 22.0 < 22.0.2020.08
Search vendor "Cisco" for product "Broadworks Application Server" and version " >= 22.0 < 22.0.2020.08"
-
Affected
Cisco
Search vendor "Cisco"
 Broadworks Application Server
Search vendor "Cisco" for product "Broadworks Application Server"
 >= 23.0 < 23.0.2020.08
Search vendor "Cisco" for product "Broadworks Application Server" and version " >= 23.0 < 23.0.2020.08"
-
Affected
Cisco
Search vendor "Cisco"
 Broadworks Application Server
Search vendor "Cisco" for product "Broadworks Application Server"
 >= 24.0 < 24.0.2020.08
Search vendor "Cisco" for product "Broadworks Application Server" and version " >= 24.0 < 24.0.2020.08"
-
Affected