Cisco Warns of Critical RCE Flaw in Communications Software

Summary

Cisco has identified a remote code execution vulnerability (CVE-2024-20253) within several of its Communication Manager and Contact Center solutions products. Cisco has rated this as a Critical Vulnerability with a CVSS base score of 9.9/10. Due to the improper processing of user provided data into memory, an attacker can exploit this vulnerability by sending a specifically crafted message to a listening port on the affected device. This can lead to Remote Code Execution and could result in the attacker gaining root access.

Impact Assessment

If a malicious user created a specially crafted message to a listening port, they could potentially send arbitrary commands to gain root access. This could lead to a loss of CIA (confidentiality, integrity, and availability.)

What it means for you

Affected Products:

• Packaged Contact Center Enterprise (PCCE) versions 12.0 and earlier, 12.5(1) and 12.5(2)
• Unified Communications Manager (Unified CM) versions 11.5, 12.5(1), and 14. (same for Unified CM SME)
• Unified Communications Manager IM & Presence Service (Unified CM IM&P) versions 11.5(1), 12.5(1), and 14.
• Unified Contact Center Enterprise (UCCE) versions 12.0 and earlier, 12.5(1), and 12.5(2).
• Unified Contact Center Express (UCCX) versions 12.0 and earlier and 12.5(1).
• Unity Connection versions 11.5(1), 12.5(1), and 14.
• Virtualized Voice Browser (VVB) versions 12.0 and earlier, 12.5(1), and 12.5(2).
• If your environment has one of the prior Cisco products, please follow the remediation and mitigation steps below.

Remediation

To remediate this vulnerability, Cisco has advised updating to the latest versions of its software.

• PCCE: 12.5(1) and 12.5(2) apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn.
• Unified CM and Unified CME: 12.5(1)SU8 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512. 14SU3 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512.
• Unified CM IM&P: 12.5(1)SU8 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512. 14SU3 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512.
• UCCE: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).
• UCCX: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1).
• VVB: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).

Business Implications

Currently this exploit has not been used in the wild but could lead to severe implications if left unchecked. Gaining root access to a system can lead to a loss in CIA (Confidentiality, Integrity, and Availability) as a result leading to a loss in reputation, revenue, and data. Gaining root access is the highest level of privilege barring having the device physically. Remediation and incident response efforts will be costly and depending on the device which is affected, could be devastating to day-to-day business operations.

Access Point Technology Recommends

Update Cisco Solutions: Patches are available from Cisco for remediation

1. Mitigate: Cisco recommends setting up ACLs (access control lists) on intermediary devices that separate the Cisco Unified Communications or Cisco Contact Center Solutions cluster from users and the rest of the network to allow access only to the ports of deployed services.
2. Harden: These guides list best practices that can help protect your Cisco solutions by listing the security features available and recommended configuration.

Chapter: Operating System and Security Hardening - Contains sections on the security features within, audit logs, determining policy, etc.

Chapter: Unified Contact Center Security Wizard - Contains sections on Cisco's security wizard, Firewall configuration, SQL Hardening, etc.

Associated Bulletins

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm

https://nvd.nist.gov/vuln/detail/CVE-2023-20253

https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-rce-flaw-in-communications-software/

‍