Cisco Unified Communications Manager (Unified CM)
Cisco Unified CM is an enterprise on-premises platform that manages voice calls, video conferencing, and internal communications for large organisations — the phone system backbone for thousands of businesses.
Root Cause
The WebDialer service fails to properly validate or restrict incoming HTTP requests. It processes attacker-supplied input without checking whether the request originates from a legitimate internal source. This allows the server to be directed toward resources it should never reach.
Attack Vector
An attacker sends a crafted HTTP request to the WebDialer endpoint, requiring no login. The server processes it as trusted, allowing the attacker to write a file to the OS and escalate to root. A public proof-of-concept (PoC) exploit is now available, and active exploitation has been observed from at least one source.
Detection Notes
- Look for unexpected file creation events in OS-level logs on Unified CM nodes
- Monitor WebDialer service logs for requests containing
file://URI patterns - Check for new or unrecognised processes running with root privileges on Unified CM hosts
Recommended Actions
- Apply Cisco's patch, released June 3 — prioritise this immediately
- If patching is not possible today, disable the WebDialer service until the patch is applied
- Restrict network access to Unified CM admin interfaces to trusted IP ranges only