var-200412-0889
Vulnerability from variot

Cisco Unity 2.x, 3.x, and 4.x, when integrated with Microsoft Exchange, has several hard coded usernames and passwords, which allows remote attackers to gain unauthorized access and change configuration settings or read outgoing or incoming e-mail messages. It is reported that vulnerable Unity systems contain default user accounts and passwords that can be used by an attacker to gain unauthorized access. This issue only arises when Unity is integrated with Microsoft Exchange. Unauthorized attakers may use these accounts to gain administrative access to vulnerable systems. Some accounts can allow attackers to disclose messages going to and from external voicemail systems. When used in conjunction with Exchange, there are multiple default username/password combinations. These default accounts are: EAdmin UNITY_ UAMIS_ UOMNI_ UVPIM_ ESubsubscriber Accessible management interface with EAdmin for application control. Any incoming or outgoing messages can be read using UNITY_, UAMIS_, UOMNI_ or UVPIM_

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200412-0889",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "3.3"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "3.2"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "3.1"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "3.0"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "2.46"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "2.4"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "2.3"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "2.2"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "2.1"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "2.0"
      },
      {
        "model": "unity server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "4.0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "11954"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:2.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:2.46:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:unity_server:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Security bulletin",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2004-1322",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": true,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-9752",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2004-1322",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200412-064",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-9752",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9752"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Unity 2.x, 3.x, and 4.x, when integrated with Microsoft Exchange, has several hard coded usernames and passwords, which allows remote attackers to gain unauthorized access and change configuration settings or read outgoing or incoming e-mail messages. It is reported that vulnerable Unity systems contain default user accounts and passwords that can be used by an attacker to gain unauthorized access.  This issue only arises when Unity is integrated with Microsoft Exchange. \nUnauthorized attakers may use these accounts to gain administrative access to vulnerable systems.  Some accounts can allow attackers to disclose messages going to and from external voicemail systems. When used in conjunction with Exchange, there are multiple default username/password combinations. These default accounts are: EAdmin\u003csystemid\u003e UNITY_\u003cservername\u003e UAMIS_\u003cservername\u003e UOMNI_\u003cservername\u003e UVPIM_\u003cservername\u003e ESubsubscriber Accessible management interface with EAdmin \u003csystemid\u003e for application control. Any incoming or outgoing messages can be read using UNITY_\u003cservername\u003e, UAMIS_\u003cservername\u003e, UOMNI_\u003cservername\u003e or UVPIM_\u003cservername\u003e",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "db": "BID",
        "id": "11954"
      },
      {
        "db": "VULHUB",
        "id": "VHN-9752"
      }
    ],
    "trust": 1.26
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "11954",
        "trust": 2.0
      },
      {
        "db": "NVD",
        "id": "CVE-2004-1322",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064",
        "trust": 0.7
      },
      {
        "db": "CIAC",
        "id": "P-060",
        "trust": 0.6
      },
      {
        "db": "CISCO",
        "id": "20041215 CISCO UNITY INTEGRATED WITH EXCHANGE HAS DEFAULT PASSWORDS",
        "trust": 0.6
      },
      {
        "db": "XF",
        "id": "18489",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-9752",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9752"
      },
      {
        "db": "BID",
        "id": "11954"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "id": "VAR-200412-0889",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9752"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:35:45.414000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/11954"
      },
      {
        "trust": 1.7,
        "url": "http://www.ciac.org/ciac/bulletins/p-060.shtml"
      },
      {
        "trust": 1.7,
        "url": "http://www.cisco.com/warp/public/707/cisco-sa-20041215-unity.shtml"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18489"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/18489"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com/en/us/products/products_security_advisory09186a008037cd59.shtml"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/384548"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9752"
      },
      {
        "db": "BID",
        "id": "11954"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-9752"
      },
      {
        "db": "BID",
        "id": "11954"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2004-12-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-9752"
      },
      {
        "date": "2004-12-15T00:00:00",
        "db": "BID",
        "id": "11954"
      },
      {
        "date": "2004-12-15T05:00:00",
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "date": "2004-12-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-9752"
      },
      {
        "date": "2004-12-15T00:00:00",
        "db": "BID",
        "id": "11954"
      },
      {
        "date": "2017-07-11T01:30:55.357000",
        "db": "NVD",
        "id": "CVE-2004-1322"
      },
      {
        "date": "2005-10-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "integrated Exchange of Cisco Unity There is a default password vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Configuration Error",
    "sources": [
      {
        "db": "BID",
        "id": "11954"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-064"
      }
    ],
    "trust": 0.9
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.