Cisco has released a patch to address a critical security vulnerability affecting its unified communications and contact center solution products that could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.
Tracked as CVE-2024-20253 (CVSS score: 9.9), this issue results from improper handling of user-supplied data that could be misused by threat actors to send specially crafted messages to a vulnerable device’s listening port.
“A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the network service user,” Cisco said in a report. “By gaining access to the underlying operating system, the attacker could also Create root access on the device.”
Synacktiv security researcher Julien Egloff is credited with discovering and reporting CVE-2024-20253. The following products are affected by this defect –
- Unified Communications Manager (versions 11.5, 12.5(1) and 14)
- Unified Communications Manager IM & Presence Service (versions 11.5(1), 12.5(1), and 14)
- Unified Communications Manager Session Management Edition (versions 11.5, 12.5(1), and 14)
- Unified Contact Center Express (versions 12.0 and earlier and 12.5(1))
- Unity Connection (versions 11.5(1), 12.5(1), and 14), and
- Virtual Voice Browser (versions 12.0 and earlier, 12.5(1) and 12.5(2))
While there is no workaround for the flaw, network equipment manufacturers urge users to set access control lists to limit access to updates that cannot be applied immediately.
“Establish access control lists (ACLs) on intermediary devices that separate the Cisco Unified Communications or Cisco Contact Center Solution cluster from users and the rest of the network, allowing access only to the ports where the service is deployed,” the company said. “
A few weeks ago, Cisco released a fix for a critical security vulnerability (CVE-2024-20272, CVSS score: 7.3) affecting Unity Connection that could allow an attacker to execute arbitrary commands on the underlying system.
