CVE-2011-1609

SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly...

8.5 HighPublic exploit

CVE-2011-1609 is a high vulnerability (CVSS 8.5) in Cisco Unified Communications Manager, published May 3, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.8%, the 97th percentile. No source names a fixed version.

SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before 8.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtg85647.

Exploit likelihood

19.8%Up 18.6 points since Feb 4, 2022

What each source reports

NVD Score used 8.5

Record: CVE-2011-1609
CVSS 2.0: 8.5 HighAV:N/AC:M/Au:S/C:C/I:C/A:C
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-1609
Updated: 2026-11-02

EUVDEUVD-2011-1609 No score

Record: EUVD-2011-1609
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x2j3-3jfh-q9x7 No score

SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly...

Record: GHSA-x2j3-3jfh-q9x7
Weakness: CWE-89
Updated: 2026-11-02

Affected products

cisco unified communications manager

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Cisco Unified Communications Manager 8.5 - 'xmldirectorylist.jsp' Multiple SQL Injections	2011-04-27

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

Exploit likelihood

What each source reports

Affected products

Public exploits

History

References