What’s Vulnerable › Vulnerabilities

CVE-2008-2062

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-06-26 · updated 2026-06-16
• Weakness: CWE-264

Description

The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4.2(3)SR4, and 4.3 before 4.3(2)SR1, allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service port, aka Bug ID CSCsq35151.

Affected products

• Cisco Unified Communications Manager: from 4.2 before 4.2\(3\)sr4; from 4.3 before 4.3\(2\)sr1; from 5.0 before 5.1\(3c\); from 6.0 before 6.1\(2\) — fixed in 4.2\(3\)sr4, 4.3\(2\)sr1, 5.1\(3c\), 6.1\(2\)

How to fix

Upgrade to a fixed version: Cisco Unified Communications Manager 4.2\(3\)sr4, 4.3\(2\)sr1, 5.1\(3c\), 6.1\(2\). Check the vendor advisory for mitigations.

References

• http://secunia.com/advisories/30848
• http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtml
• http://www.securityfocus.com/bid/29935
• http://www.securitytracker.com/id?1020361
• http://www.vupen.com/english/advisories/2008/1933/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43355
• http://secunia.com/advisories/30848
• http://www.cisco.com/en/US/products/products_security_advisory09186a00809b9011.shtml
• http://www.securityfocus.com/bid/29935
• http://www.securitytracker.com/id?1020361
• http://www.vupen.com/english/advisories/2008/1933/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43355

Get alerted when CVE-2008-2062 or the next vulnerability affects your stack