Read the docs
TI-2008-01672 Aliases CVE-2008-1744GHSA-xx57-275q-jj4j

The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications…

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR7, 4.2 before 4.2(3)SR4, and 4.3 before 4.3(2) allows remote attackers to cause a denial of service (service crash) via malformed network traffic, aka Bug ID CSCsk46770.

Why it matters now

EPSS 0.01179 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:cisco:unified_callmanager:4.1:*:*:*:*:*:*:*4.1VulnerableCisco
cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr4:*:*:*:*:*:*:*4.1_3_sr4VulnerableCisco
cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr5:*:*:*:*:*:*:*4.1_3_sr5VulnerableCisco
cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr5b:*:*:*:*:*:*:*4.1_3_sr5bVulnerableCisco
cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr5c:*:*:*:*:*:*:*4.1_3_sr5cVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:4.2_3_sr2:*:*:*:*:*:*:*4.2_3_sr2VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:4.2_3_sr2b:*:*:*:*:*:*:*4.2_3_sr2bVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:4.2_3_sr3:*:*:*:*:*:*:*4.2_3_sr3VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:4.3:*:*:*:*:*:*:*4.3VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:4.3_1_sr1:*:*:*:*:*:*:*4.3_1_sr1VulnerableCisco
  • cpe:2.3:a:cisco:unified_callmanager:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr4:*:*:*:*:*:*:* Versions 4.1_3_sr4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr5:*:*:*:*:*:*:* Versions 4.1_3_sr5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr5b:*:*:*:*:*:*:* Versions 4.1_3_sr5b Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_callmanager:4.1_3_sr5c:*:*:*:*:*:*:* Versions 4.1_3_sr5c Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:4.2_3_sr2:*:*:*:*:*:*:* Versions 4.2_3_sr2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:4.2_3_sr2b:*:*:*:*:*:*:* Versions 4.2_3_sr2b Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:4.2_3_sr3:*:*:*:*:*:*:* Versions 4.2_3_sr3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:4.3_1_sr1:*:*:*:*:*:*:* Versions 4.3_1_sr1 Vulnerable ·Cisco
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:unified_communications_manager:5.1_1:*:*:*:*:*:*:*5.1_1VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:5.1_2:*:*:*:*:*:*:*5.1_2VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:5.1_2a:*:*:*:*:*:*:*5.1_2aVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:5.1_2b:*:*:*:*:*:*:*5.1_2bVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:5.1_3a:*:*:*:*:*:*:*5.1_3aVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:6.0:*:*:*:*:*:*:*6.0VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:6.0_1:*:*:*:*:*:*:*6.0_1VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:6.0_1a:*:*:*:*:*:*:*6.0_1aVulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:6.1:*:*:*:*:*:*:*6.1VulnerableCisco
cpe:2.3:a:cisco:unified_communications_manager:6.1_1a:*:*:*:*:*:*:*6.1_1aVulnerableCisco
  • cpe:2.3:a:cisco:unified_communications_manager:5.1_1:*:*:*:*:*:*:* Versions 5.1_1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:5.1_2:*:*:*:*:*:*:* Versions 5.1_2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:5.1_2a:*:*:*:*:*:*:* Versions 5.1_2a Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:5.1_2b:*:*:*:*:*:*:* Versions 5.1_2b Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:5.1_3a:*:*:*:*:*:*:* Versions 5.1_3a Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:6.0_1:*:*:*:*:*:*:* Versions 6.0_1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:6.0_1a:*:*:*:*:*:*:* Versions 6.0_1a Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_manager:6.1_1a:*:*:*:*:*:*:* Versions 6.1_1a Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-1744
  2. 2026-10-03 Alias added: GHSA-xx57-275q-jj4j

References

Advisory 1

Other 1

  • TI-2008-00019 Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service… CVSS 2.0HIGH 10.0
  • TI-2006-05092 Integer overflow in the Real-Time Information Server (RIS) Data Collector service… CVSS 2.0HIGH 10.0
  • TI-2006-05091 Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe)… CVSS 2.0HIGH 9.3
  • TI-2007-05323 Buffer overflow in the Centralized TFTP File Locator Service in Cisco Unified… CVSS 2.0HIGH 10.0
  • TI-2006-05364 Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as… CVSS 2.0HIGH 7.8
  • TI-2009-02727 Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g)… CVSS 2.0HIGH 7.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences