CVE-2014-3300 in the critical feed json
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10…
published 2014-07-07 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-3313
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 21.9%
- EPSS 21.9% chance of exploitation in 30 days, percentile 97%
- public exploits
- 2
- Metasploit
Summary
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application Software before 10 does not properly implement access control, which allows remote attackers to modify user information via a crafted URL, aka Bug ID CSCum77041.
Exploit prediction
21.88% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/voip/cisco_cucdm_call_forward Viproy CUCDM IP Phone XML Services - Call Forwarding Tool metasploit auxiliary, normal rank
- Metasploit auxiliary/voip/cisco_cucdm_speed_dials Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool metasploit auxiliary, normal rank
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
vendor-advisory
-
tools.cisco.com
/security/center/viewAMBAlert.x?alertId=34689
vendor-advisory
-
securitytracker.com
/id/1030515
vdb-entry, third-party-advisory
-
secunia.com
/advisories/59556
third-party-advisory
-
securityfocus.com
/bid/68331
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2014-3300
- NVD CVE-2014-3300
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.