10
CVE-2024-20253
- EPSS 2.4%
- Veröffentlicht 26.01.2024 18:15:10
- Zuletzt bearbeitet 29.05.2025 16:15:33
- Erkennungen
LoginA vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Unified Communications Manager SwEdition - Version < 12.5\(1\)su8
Cisco ≫ Unified Communications Manager Version >= 14.0 < 14su3
Cisco ≫ Unified Communications Manager SwEdition session_management Version < 12.5\(1\)su8
Cisco ≫ Unified Communications Manager SwEdition session_management Version >= 14.0 < 14su3
Cisco ≫ Unified Communications Manager Im And Presence Service Version < 12.5\(1\)su8
Cisco ≫ Unified Communications Manager Im And Presence Service Version >= 14.0 < 14.0su3
Cisco ≫ Unity Connection Version < 12.5\(1\)su8
Cisco ≫ Unity Connection Version >= 14.0 < 14su3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.4% | 0.823 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 10 | 3.9 | 6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
| Cisco PSIRT | 9.9 | 3.9 | 5.3 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm