Cisco Unified Communications Products Arbitrary File Write Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to write arbitrary files on the affected system. This vulnerability is due to improper restrictions applied to a system script. An attacker could exploit this vulnerability by using crafted variables during the execution of a system upgrade. A successful exploit could allow the attacker to overwrite or append arbitrary data to system files using root-level privileges.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Unified Communications Manager | all versions | — | No fix listed | CNA |
- Cisco Unified Communications Manager VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:-:*:*:* | 12.5(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:session_management:*:*:* | 12.5(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_communications_manager:14.0:*:*:*:-:*:*:* | 14.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_communications_manager:14.0:*:*:*:session_management:*:*:* | 14.0 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:-:*:*:* Versions 12.5(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:session_management:*:*:* Versions 12.5(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_communications_manager:14.0:*:*:*:-:*:*:* Versions 14.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_communications_manager:14.0:*:*:*:session_management:*:*:* Versions 14.0 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-20789
- 2026-10-03 Alias added: GHSA-8rhg-6qwg-6c3v
References
More Cisco Unified Communications Manager vulnerabilities
- TI-2026-16259 Cisco Unified Communications Products Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16423 Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability KEVCVSS 3.1HIGH 8.6
- TI-2008-00019 Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service… CVSS 2.0HIGH 10.0
- TI-2013-05779 The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows… CVSS 3.1HIGH 7.3
- TI-2011-02932 Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and… CVSS 2.0HIGH 7.8
Sources
- CVE-2022-20789 · CVE Program
- CVE-2022-20789 · NVD
- FIRST EPSS
- GHSA-8rhg-6qwg-6c3v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences