PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3833 Cisco CVE debrief

CVE-2017-3833 is a medium-severity cross-site scripting vulnerability in the web framework of Cisco Unified Communications Manager. Cisco and NVD describe it as allowing an unauthenticated, remote attacker to conduct an XSS attack against a user of the affected web interface. The supplied record lists one known affected release, 12.0(0.99999.2), and multiple fixed releases across 11.0, 11.5, 11.6, and 12.0 builds.

Vendor
Cisco
Product
Unified Communications Manager
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

Cisco Unified Communications Manager administrators, identity and collaboration platform teams, web application security teams, and organizations exposing the CUCM web interface to users should prioritize this issue.

Technical summary

The vulnerability is classified as CWE-79 (cross-site scripting). NVD summarizes the attack vector as network-based with low attack complexity, no privileges required, and user interaction required, with changed scope and low confidentiality/integrity impact. In practical terms, a remote unauthenticated attacker can trigger script execution in a user's browser through the CUCM web interface, which can affect the user session or trust boundary of the web application.

Defensive priority

Medium. The issue is externally reachable and unauthenticated, but it requires user interaction and is rated CVSS 6.1. It should be remediated promptly on any exposed or actively used Cisco Unified Communications Manager deployment.

Recommended defensive actions

  • Upgrade Cisco Unified Communications Manager to a fixed release listed in the record.
  • Confirm whether any deployment is running the known affected release 12.0(0.99999.2) or another vulnerable build covered by Cisco's fixed-release matrix.
  • Review and harden access to the CUCM web interface, especially for administrative or broadly used user-facing pages.
  • Apply web security controls that reduce XSS impact, including output encoding and content-security controls where supported by the product.
  • Validate browser-session and authentication protections for users who access the CUCM web interface.
  • Track Cisco security advisories and replace any interim workaround with a vendor-fixed release as soon as possible.

Evidence notes

The vulnerability description, CVSS score/severity, published date, and fixed/affected release information come from the supplied CVE record. NVD metadata identifies CWE-79 and the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The supplied enrichment data indicates this CVE is not on CISA KEV and has no ransomware-campaign flag in the provided corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3833 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3833

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3833 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3833

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.