Critical severity9.8NVD Advisory· Published Nov 8, 2018· Updated Jun 17, 2026
CVE-2018-15381
CVE-2018-15381
Description
A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:cisco:unity_express:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:cisco:unity_express:*:*:*:*:*:*:*:*range: <9.0.6
- (no CPE)
- (no CPE)range: n/a
Patches
Vulnerability mechanics
References
3- www.securityfocus.com/bid/105876nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1042130nvdThird Party AdvisoryVDB Entry
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cuenvdVendor Advisory
News mentions
0No linked articles in our index yet.