This vulnerability in Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise enables an authenticated attacker to perform SSRF attacks by sending specially crafted HTTP requests. Due to insufficient input validation, the attacker can cause the device to initiate arbitrary network requests, potentially impacting internal network resources. Exploitation requires valid authentication credentials on the device. The CVSS 3.1 base score is 5.0, reflecting medium severity with network attack vector, low attack complexity, and privileges required. No official remediation or patch information is currently available.

An authenticated attacker with valid credentials can exploit this vulnerability to send arbitrary network requests from the affected device. This could allow the attacker to access or interact with internal network resources that are otherwise inaccessible, potentially leading to information disclosure or further attacks within the network. There is no direct impact on confidentiality, but integrity is impacted. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user access to trusted personnel only and monitor for suspicious activity involving HTTP requests. No official remediation or temporary fixes have been published by Cisco at this time.