CVE-2014-0657
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier...
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
Exploit likelihood
What each source reports
NVD Score used
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
- Record
CVE-2014-0657- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
- Record
CVE-2014-0657- Updated
- 2026-11-02
EUVDEUVD-2014-0688 No score
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
- Record
EUVD-2014-0688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vm36-ppgc-f683 No score
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier...
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
- Record
GHSA-vm36-ppgc-f683- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0657 is a medium vulnerability (CVSS 4.0) in Cisco Unified Communications Manager, published January 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. No source names a fixed version.
References
osvdb.org/101800
exchange.xforce.ibmcloud.com/vulnerabilities/90120
secunia.com/advisories/56368
tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0657
securityfocus.com/bid/64690
securitytracker.com/id/1029571
nvd.nist.gov/vuln/detail/CVE-2014-0657
github.com/advisories/GHSA-vm36-ppgc-f683