DESCRIPTION:
A vulnerability(CVE-2024-20253) in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device.
AFFECTED RELEASES:
Unified Communications Manager version 11.5(1), 12.5(1),and 14
Unified Communications Manager IM & Presence Service version 11.5(1), 12.5(1),and 14
Unified Communications Manager Session Management Edition version 11.5(1), 12.5(1),and 14
Unified Contact Center Express version below 12.0 and version 12.5(1)
Unity Connection version 11.5(1), 12.5(1),and 14
Virtualized Voice Browser version below 12.0, version 12.5(1), 12.5(2), 12.6(1),and 12.6(2)
SOLUTION:
1. Users and system administrators of affected products are advised to refer to the official webpage (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm#fs) and apply the security updates:
REFERENCE:
1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm
2. https://nvd.nist.gov/vuln/detail/CVE-2024-20253
3. https://thehackernews.com/2024/01/critical-cisco-flaw-lets-hackers.html