A critical vulnerability exists in Cisco Unified Communications Manager and its Session Management Edition. This flaw allows an unauthenticated, remote attacker to perform server-side request forgery (SSRF) attacks. The vulnerability stems from improper input validation within specific HTTP requests. Attackers can exploit this by sending a specially crafted HTTP request to an affected device. Successful exploitation enables attackers to write files to the underlying operating system. These written files can subsequently be used to elevate privileges to root access. Cisco specifically rated this vulnerability as Critical due to the potential for root privilege escalation. It is important to note that exploitation requires the WebDialer service to be enabled on the affected device. WebDialer is disabled by default, which somewhat mitigates the immediate risk. Cisco has released software updates to address this security flaw. Currently, no workarounds are available for this vulnerability. The official advisory provides further details on this critical security issue.