10

CVE-2024-20253

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Unified Communications Manager SwEdition- Version < 12.5\(1\)su8
Cisco ≫ Unified Communications Manager Version >= 14.0 < 14su3
Cisco ≫ Unified Communications Manager SwEditionsession_management Version < 12.5\(1\)su8
Cisco ≫ Unified Communications Manager SwEditionsession_management Version >= 14.0 < 14su3
Cisco ≫ Unity Connection Version < 12.5\(1\)su8
Cisco ≫ Unity Connection Version >= 14.0 < 14su3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 3.03% 0.861
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
psirt@cisco.com 9.9 3.9 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.