CVE-2013-4869

Severity CVSS v4.0:

Pending analysis

Type:

CWE-522 Insufficiently Protected Credentials

Publication date:

18/07/2013

Last modified:

11/04/2025

Description

Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) and the IM & Presence Service in Cisco Unified Presence Server through 9.1(2) use the same CTI and database-encryption key across different customers&#39; installations, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key, aka Bug IDs CSCsc69187 and CSCui01756. NOTE: the vendor has provided a statement that the "hard-coded static encryption key is considered a hardening issue rather than a vulnerability, and as such, has a CVSS score of 0/0."

Impact

Vector 2.0

AV:N/AC:L/Au:N/C:N/I:N/A:N CVSS v2.0 Severity and Metrics:

Base Score: 0.00 LOW
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): None
Integrity (I): None
Availability (A): None