I'm told by Cisco TAC that 12.5(1)SU3 is not affected by this finding.  Unfortunately the public page states that 12.5(1) is affected (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-cuc-imp-xss-OWuSYAp).  Can we g...