Description
Cisco allows the Serviceability Monitoring tool to be accessed via Real-Time Monitoring Tool provided that the user supplies the administrator login credentials. However, due to a flaw in the implementation it is possible to bypass the authentication layer and directly interact with the Serviceability Monitoring tool to gain unauthorized access to the Server Processes function.
Recommendations
Cisco has acknowledged the issue and is issuing patches to correct it. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. It is therefore recommended to restrict access to TCP port 2556 on vulnerable CCM and CUCM servers to CCM/CUCM cluster nodes and authorized administrator workstations . Cisco customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.