Description
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.
This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Finesse | 12.6(1), 12.6(1)ES1, 12.6(1)ES2, 12.6(1)ES3, 12.6(1)ES4, 12.6(1)ES5, 12.6(1)ES6, 12.6(1)ES7, 12.6(1)ES7_ET, 12.6(2), 12.6(1)ES8, 12.6(1)ES9, 12.6(2)ES1, 12.6(1)ES10, 12.6(1)ES11, 12.6(2)ES2, 12.6(2)ES3, 12.6(2)ES4, 12.6(2)ES5, 15.0(1), 12.6(2)ES6, 15.0(1)ES202508, 15.0(1)ES202511, 15.0(1)ES202602, … | — |
Advisories 1
- WID-SEC-2026-3794 Cisco Finesse, Unified CCE, Unified CCX: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 7, 2026