This vulnerability arises from improper input validation of specific HTTP requests in Cisco Unified Communications Manager and Unified CM SME. An attacker can exploit this by sending specially crafted HTTP requests to the device when the WebDialer service is enabled. The SSRF flaw enables writing files to the operating system, which can be leveraged to escalate privileges to root. The vulnerability is unauthenticated and remote, increasing its risk if the WebDialer service is active. Cisco notes the critical impact due to the possibility of root privilege escalation, although the CVSS score rates it as high severity.

An unauthenticated remote attacker can exploit this SSRF vulnerability to write files on the underlying operating system of affected Cisco Unified Communications Manager devices, potentially escalating privileges to root. This could lead to full system compromise. However, exploitation requires the WebDialer service to be enabled, which is disabled by default, limiting exposure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Cisco advisory for current remediation guidance. Since the WebDialer service must be enabled for exploitation and it is disabled by default, ensure that WebDialer remains disabled if not required. Monitor Cisco's official advisories for patches or updates addressing this vulnerability.