What’s Vulnerable › Vulnerabilities

CVE-2018-15381: Cisco Unity Express Arbitrary Command Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 87.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-08 · updated 2026-06-17
• Weakness: CWE-502

Description

A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.

Affected products

• Cisco Unity Express: before 9.0.6 — fixed in 9.0.6

How to fix

Upgrade to a fixed version: Cisco Unity Express 9.0.6. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/105876
• http://www.securitytracker.com/id/1042130
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue
• http://www.securityfocus.com/bid/105876
• http://www.securitytracker.com/id/1042130
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue

Get alerted when CVE-2018-15381 or the next vulnerability affects your stack