Skip to main content
عربي
logo

NCSC-TAD-2402-001

Severity Level: Critical
Vulnerability

Reference No.: NCSC-TAD-2402-001CVSS 0

Critical Vulnerability CVE-2024-20253 in Cisco Unified Communications Products

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2024-20253

Overview

Cisco has patched a critical Remote Code Execution (RCE) vulnerability in multiple Unified Communications and Contact Center Solutions products. The vulnerability tracked as CVE-2024-20253 with a CVSS score of 9.9. Threat actors exploit the improper processing of user-provided data that is being read into memory by sending a crafted message to a listening port on the vulnerable machine. Successful exploitation grants the ability to execute arbitrary commands and gain root access.

Affected Technologies

  • Packaged Contact Center Enterprise (PCCE): Versions 12.0 and earlier, 12.5(1) and 12.5(2).
  • Unified Communications Manager (Unified CM) and Unified CM SME: Versions 11.5, 12.5(1), and 14.
  • Unified Communications Manager IM & Presence Service (Unified CM IM&P): Versions 11.5(1), 12.5(1), and 14.
  • Unified Contact Center Enterprise (UCCE): Versions 12.0 and earlier, 12.5(1), and 12.5(2).
  • Unified Contact Center Express (UCCX): Versions 12.0 and earlier and 12.5(1).
  • Unity Connection: Versions 11.5(1), 12.5(1), and 14.
  • Virtualized Voice Browser (VVB): Versions 12.0 and earlier, 12.5(1), and 12.5(2).

Mitigation and Immediate Actions

  1. 01

    The National Cyber Security Centre recommends all the entities to apply the latest security patch issued by Cisco.

  2. 02

    If an immediate update is not feasible, set up the Access Control Lists (ACLs) on intermediary devices that separate the Cisco Unified Communications or Cisco Contact Center Solutions cluster from users and the network. These ACLs should only grant access to the ports of deployed services.

References