Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-3039 — OS Command Injection in Cisco Unified Communications Manager

CWE-78 — OS Command Injection5 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
2.6%
top 14.31%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Cisco Unified Communications Manager
Timeline
PublishedNov 9
Latest updateMay 14

Description

/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.1 | Impact: 10.0

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-xrvh-hj29-j7h9: /usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated↗2022-05-14
▶
CVEList
CVE-2010-3039: /usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated↗2010-11-09
▶

💥Exploits & PoCs

2
Exploit-DB
Cisco Unified Communications Manager 8.0 - Invalid Argument Privilege Escalation↗2010-11-03
▶
Exploit-DB
Microsoft Message Queueing Service - DNS Name Path Overflow (MS07-065) (Metasploit)↗2010-07-25
▶
CVE-2010-3039 — OS Command Injection in Cisco | cvebase