CVE-2007-4633: Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager...

Security readout for executives and security teams

This issue affects older Cisco CallManager and Unified Communications Manager logon pages. A remote attacker could inject malicious script or HTML through the language parameter, potentially exposing users or administrators to credential theft, session abuse, or misleading content if they interact with a crafted page. Exposure is mainly legacy Cisco voice infrastructure still running the listed pre-fix versions, especially if user or administrator logon pages are reachable from broad internal networks or the internet. Treat this as a legacy infrastructure cleanup item unless vulnerable systems remain exposed. Prioritize quickly if CUCM administration is reachable beyond trusted networks or if unsupported versions remain in production. Mitigation focus: Upgrade Cisco CallManager/CUCM to the fixed release for the deployed branch or later.; Review the Cisco advisory for branch-specific upgrade guidance and related issues.; Restrict administrative logon pages to trusted management networks..

Prepared

Jun 29, 2026, 03:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.