Cisco has urged developers to add software updates to multiple unified contact centre business products that include Apache Struts 2 software.
The networking firm issued a patch for the four-year-old vulnerability, which would have allowed a malicious hacker to bypass the ‘#’-usage protection built into the ParametersInterceptor.
"An attacker could exploit this vulnerability by sending crafted requests that contain OGNL expressions to an affected system. An exploit could allow the attacker to execute arbitrary code on the targeted system," Cisco said in a statement.
"This vulnerability has been confirmed to allow remote code execution with the privileges of the Administrator user for the Cisco Unified CCE. Exploitation on Cisco ISE, Cisco MXE 3500, and Cisco Business Edition 3000 Series is theoretically possible but could not be reproduced," it added.
Cisco has released free software updates that address this vulnerability for all affected products except Cisco Business Edition 3000 Series.
Users using Cisco Business Edition 3000 Series should contact their Cisco representative for available options, Cisco said
