SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76419

MEDIUM(6.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Risk Signal Score20/100 — NIEDRIG
  • CVSS 6.1 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.1

Technische Schwere

Beschreibung

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 15SU5

Threat-Hunting-Queries

Detecting XSS exploitation often requires monitoring web server logs for unusual requests, especially those containing script tags or encoded characters in URL parameters or HTTP headers. This query looks for common XSS patterns in web access logs.

Sentinel/Defender KQL

CommonSecurityLog
| where DeviceVendor == "Cisco" and DeviceProduct contains "Unified CM"
| where RequestURL contains "<script>" or RequestURL contains "%3Cscript%3E" or RequestURL contains "javascript:"
| project TimeGenerated, DeviceName, RequestURL, SourceIP

Splunk SPL

sourcetype=cisco_ucm_access_logs (uri_path="*<script>*" OR uri_path="*%3Cscript%3E*" OR uri_path="*javascript:*")
| table _time, host, uri_path, clientip

Sigma

title: Cisco Unified CM XSS Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential Cross-Site Scripting (XSS) attempts against Cisco Unified Communications Manager web interface.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z
logsource:
  product: cisco
  service: unified_cm
detection:
  selection:
    url|contains:
      - '<script>'
      - '%3Cscript%3E'
      - 'javascript:'
  condition: selection
level: medium

Elastic ES|QL

FROM cisco_unified_cm_logs
| WHERE url.original : "*<script>*" OR url.original : "*%3Cscript%3E*" OR url.original : "*javascript:*"
| SELECT @timestamp, host.name, url.original, source.ip

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen