CVE-2024-20253

The vulnerability results from improper processing of user-supplied data during loading into memory (CWE-502 — deserialization of untrusted data). An attacker sends a specially crafted message to a listening port on the vulnerable device. Successful exploitation of the vulnerability allows execution of arbitrary commands in the context of the web service user, and subsequently gaining root access to the operating system.

An attacker can execute arbitrary commands on the device's operating system with web service user privileges, and subsequently gain full root access to the device. This exposes the system to loss of confidentiality, integrity, and availability of the entire system.

Security patches available from the manufacturer should be applied in accordance with the references (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm). Additionally, it is recommended to restrict network access to listening ports on vulnerable devices exclusively to trusted hosts using firewall or ACL rules.

Cisco Unified Communications Manager, Cisco Unified Communications Manager IM and Presence Service, Cisco Unity Connection — versions indicated in the manufacturer's references