CVE-2008-1154 json
The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products, including Unified Communications Manager (CUC…
published 2008-04-04 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1163
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.1%
- EPSS 5.1% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products, including Unified Communications Manager (CUCM) 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the network, which allows remote attackers to execute arbitrary code via unspecified vectors.
Patch / fix
Exploit prediction
5.14% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
cisco.com
/en/US/products/products_security_advisory09186a008096fd9a.shtml
vendor-advisory, patch
-
securityfocus.com
/bid/28591
vdb-entry
-
securitytracker.com
/id?1019768
vdb-entry
-
vupen.com
/english/advisories/2008/1093
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/41632
vdb-entry
-
secunia.com
/advisories/29670
third-party-advisory
Sources
- CVE List CVE-2008-1154
- NVD CVE-2008-1154
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.