This vulnerability affects multiple versions of Cisco Unity Connection (14 through 15SU3). It arises from insufficient validation of HTTP request parameters in the web management interface, enabling an attacker to perform an open redirect attack. The attacker must lure a user into clicking a maliciously crafted URL, which then redirects the user to an attacker-controlled site. The CVSS 3.1 base score is 4.7 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction needed, scope changed, no confidentiality impact, low integrity impact, and no availability impact. No official fix or patch has been documented in the provided data.

Successful exploitation results in redirecting users to potentially malicious web pages, which could facilitate phishing or other social engineering attacks. There is no direct impact on confidentiality or availability, and integrity impact is low. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should educate users to be cautious about clicking unexpected or suspicious links related to Cisco Unity Connection interfaces. No official mitigation or temporary fix is documented in the provided information.