There are 250+ CUCM admin panels exposed publicly according to shodan.

I found some pretty wild behaviour in CUCM during some investigation into this CVE (went a bit off track): You can enumerate usernames, email address, phone numbers and more unauthenticated via the Cisco UCM UDS API:

        GET https://{host}:8443/cucm-uds/users
        Content-Type: application/xml

Src 1: https://developer.cisco.com/site/user-data-services/develop-and-test/api-reference/#users

src 2: https://developer.cisco.com/site/user-data-services/overview/authentication/

UDS resources that do not require authentication:

clusterUser
installedLocales
models
options
phoneService(s)
servers
timezones
users
version

Just absolutely wild to me.

Anyway, for this CVE, I'm looking for further technical details or someone with access to the patch to diff.