Wednesday, May 14, 2025
HomeCyber Security NewsCisco Patched SQL Injection Vulnerability in Cisco Prime License Manager

Cisco Patched SQL Injection Vulnerability in Cisco Prime License Manager

Published on

SIEM as a Service

Follow Us on Google News

Cisco Patched a critical SQL Injection Vulnerability in Cisco Prime License Manager which allows an unauthenticated remote attacker to execute arbitrary SQL queries.

SQL injection is a code injection technique, in which attackers take non-validated input vulnerabilities and inject SQL commands through web applications that are executed in the backend database.

The vulnerability with Cisco Prime License Manager is due to lack of proper validation with the user-supplied input SQL queries. An unauthenticated remote attacker could exploit the vulnerability by sending an HTTP post request that contains a malicious SQL query.

- Advertisement - Google News

Successful exploitation of the vulnerability could allow an attacker to delete or modify arbitrary data or to gain privilege access as Postgres user. The vulnerability can be tracked as CVE-2018-15441 and Cisco released software updates to address the vulnerability.

The vulnerability affects Cisco Prime License Manager Releases 11.0.1 and above, Cisco Unified Communications Manager and Cisco Unity Connection Releases 12.0 and later are not affected, as the License Manager not included in these versions.

Cisco released a patch ciscocm.CSCvk30822_v1.0.k3.cop.sgn for Cisco Prime License Manager and can be applicable to Cisco Unified Communications Manager and Cisco Unity Connection 11.5(1) only, the customer who uses earlier release should update for 11.5(1) reads the Cisco Security advisory.

The patch file along with the instructions can be downloaded from here.

Related Read

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Cisco Released Security Updates & Fixed 37 Vulnerabilities that Affected Cisco Products

Cisco Patched Critical Vulnerability With Video Surveillance Manager Appliance

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actors Leverage Weaponized HTML Files to Deliver Horabot Malware

A recent discovery by FortiGuard Labs has unveiled a cunning phishing campaign orchestrated by...

TA406 Hackers Target Government Entities to Steal Login Credentials

The North Korean state-sponsored threat actor TA406, also tracked as Opal Sleet and Konni,...

Google Threat Intelligence Releases Actionable Threat Hunting Technique for Malicious .desktop Files

Google Threat Intelligence has unveiled a series of sophisticated threat hunting techniques to detect...

New Adobe Photoshop Vulnerability Enables Arbitrary Code Execution

Adobe has released critical security updates addressing three high-severity vulnerabilities (CVE-2025-30324, CVE-2025-30325, CVE-2025-30326) in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Threat Actors Leverage Weaponized HTML Files to Deliver Horabot Malware

A recent discovery by FortiGuard Labs has unveiled a cunning phishing campaign orchestrated by...

TA406 Hackers Target Government Entities to Steal Login Credentials

The North Korean state-sponsored threat actor TA406, also tracked as Opal Sleet and Konni,...

Google Threat Intelligence Releases Actionable Threat Hunting Technique for Malicious .desktop Files

Google Threat Intelligence has unveiled a series of sophisticated threat hunting techniques to detect...