Critical RCE vulnerability in Cisco Unified Communications products

A critical remote code execution vulnerability, CVE-2024-20253, has been identified in several Cisco Unified Communications and Contact Centre Solutions products. The flaw stems from improper handling of user-provided data and allows an unauthenticated remote attacker to send a specially crafted message that can lead to arbitrary code execution on affected devices, potentially with root-level control. It affects several core components including Unified Communications Manager, Unity Connection and Unified Contact Centre Express in their default configurations. Cisco has released software updates, and since no effective workarounds exist, organisations are urged to apply the fixed releases promptly.

What this means for your organisation

Telephony and contact centre platforms often sit outside ordinary vulnerability management. They are typically run by a telecoms partner, rarely included in the endpoint patching routine, and nobody thinks of them as servers. They nevertheless sit in the middle of the network with privileges to match. A contact centre platform also handles customer conversations and frequently personal data, which makes a compromise more than an operational problem.

Berigo recommends

• Ask your managed service provider to confirm in writing which versions you run and when they will be patched.
• Apply Cisco's fixed releases, since no usable workarounds exist.
• Segment the telephony and contact centre platform from the rest of the network and limit what it can reach.
• Bring telephony and contact centre systems into ordinary vulnerability management, not just supplier management.

Source

• sec.cloudapps.cisco.com
• jamf.com