TI-2019-01532 Aliases CVE-2019-1911 GHSA-m9rx-h823-vf8r

Cisco Unified Communications Domain Manager Restricted Shell Escape Vulnerability

LOW 34CWE-216Published 2019-07-06 · Updated 2024-11-21

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability in the CLI of Cisco Unified Communications Domain Manager (Cisco Unified CDM) Software could allow an authenticated, local attacker to escape the restricted shell. The vulnerability is due to insufficient input validation of shell commands. An attacker could exploit this vulnerability by executing crafted commands in the shell. A successful exploit could allow the attacker to escape the restricted shell and access commands in the context of the restricted shell user, which does not have root privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00321 25th percentileScored 2026-11-07

Fix Fixed Cisco Unified Communications Domain Manager (Cisco): 11.5(3)PB4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco Unified Communications Domain Manager	before 11.5(3)PB4	11.5(3)PB4	Patch available	CNA

Cisco Unified Communications Domain Manager VendorCisco Affected before 11.5(3)PB4 Fixed in 11.5(3)PB4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:hosted_collaboration_solution::::::::	up to 11.5\(3\)pb3	Vulnerable	Cisco

cpe:2.3:a:cisco:hosted_collaboration_solution:*:*:*:*:*:*:*:* Versions up to 11.5\(3\)pb3 Vulnerable ·Cisco

Remediation

Fix · CNA Cisco Unified Communications Domain Manager (Cisco) Fixed in 11.5(3)PB4

Timeline

2026-10-02 Threatist record created from CVE-2019-1911
2026-10-03 Alias added: GHSA-m9rx-h823-vf8r

References

Advisory 1

20190703 Cisco Unified Communications Domain Manager Restricted Shell Escape Vulnerability

TI-2017-07185 Deserialization of untrusted data in Apache Struts KEVCVSS 3.1HIGH 8.1
TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
TI-2015-00690 Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for… CVSS 2.0MEDIUM 6.8
TI-2015-00698 The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and… CVSS 2.0MEDIUM 6.5
TI-2018-00345 Cross-site scripting in Cisco Unified Communications Domain Manager Software CVSS 3.0MEDIUM 6.1
TI-2014-01672 Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS)… CVSS 2.0MEDIUM 5.0

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences