Title: Cisco Unity With Exchange Default User Accounts and Passwords Vulnerability
Severity: CRITICAL
Description:
Unity is a Cisco software product designed to unify voice message, fax, and e-mail into a user's inbox.
It is reported that vulnerable systems contain default user accounts and passwords that can be used by an attacker to gain unauthorized access. This issue only arises when Unity is integrated with Microsoft Exchange.
It is reported that the default accounts include a privileged administrative account and several messaging accounts. An unauthorized user can utilize 'EAdmin <systemid>' to gain Cisco Unity Administrator privileges. Attackers can also utilize 'UNITY_<servername>', 'UAMIS_<servername>', 'UOMNI_<servername>', and 'UVPIM_<servername>' to disclose messages going to and from external voicemail systems. Another account called ' Esubscriber' resides in the system as well. It is reported that this account does not have administrative or other special features.
Affected Products:
- Cisco Unity Server 2.0.0
- Cisco Unity Server 2.1.0
- Cisco Unity Server 2.2.0
- Cisco Unity Server 2.3.0
- Cisco Unity Server 2.4.0
- Cisco Unity Server 2.46.0
- Cisco Unity Server 3.0.0
- Cisco Unity Server 3.1.0
- Cisco Unity Server 3.2.0
- Cisco Unity Server 3.3.0
- Cisco Unity Server 4.0.0
References:
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
