CyberWatch

Cisco Warns of Critical RCE Flaw in Communications Software

By

By

Access Point Consulting

Summary

Cisco has identified a remote code execution vulnerability (CVE-2024-20253) within several of its Communication Manager and Contact Center solutions products. Cisco has rated this as a Critical Vulnerability with a CVSS base score of 9.9/10. Due to the improper processing of user provided data into memory, an attacker can exploit this vulnerability by sending a specifically crafted message to a listening port on the affected device. This can lead to Remote Code Execution and could result in the attacker gaining root access.

Impact Assessment

If a malicious user created a specially crafted message to a listening port, they could potentially send arbitrary commands to gain root access. This could lead to a loss of CIA (confidentiality, integrity, and availability.)

What it means for you

Affected Products:

  • Packaged Contact Center Enterprise (PCCE) versions 12.0 and earlier, 12.5(1) and 12.5(2)
  • Unified Communications Manager (Unified CM) versions 11.5, 12.5(1), and 14. (same for Unified CM SME)
  • Unified Communications Manager IM & Presence Service (Unified CM IM&P) versions 11.5(1), 12.5(1), and 14.
  • Unified Contact Center Enterprise (UCCE) versions 12.0 and earlier, 12.5(1), and 12.5(2).
  • Unified Contact Center Express (UCCX) versions 12.0 and earlier and 12.5(1).
  • Unity Connection versions 11.5(1), 12.5(1), and 14.
  • Virtualized Voice Browser (VVB) versions 12.0 and earlier, 12.5(1), and 12.5(2).
  • If your environment has one of the prior Cisco products, please follow the remediation and mitigation steps below.

Remediation

To remediate this vulnerability, Cisco has advised updating to the latest versions of its software.

  • PCCE: 12.5(1) and 12.5(2) apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn.
  • Unified CM and Unified CME: 12.5(1)SU8 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512. 14SU3 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512.
  • Unified CM IM&P: 12.5(1)SU8 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512. 14SU3 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512.
  • UCCE: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).
  • UCCX: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1).
  • VVB: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).

Business Implications

Currently this exploit has not been used in the wild but could lead to severe implications if left unchecked. Gaining root access to a system can lead to a loss in CIA (Confidentiality, Integrity, and Availability) as a result leading to a loss in reputation, revenue, and data. Gaining root access is the highest level of privilege barring having the device physically. Remediation and incident response efforts will be costly and depending on the device which is affected, could be devastating to day-to-day business operations.

Access Point Technology Recommends

Update Cisco Solutions: Patches are available from Cisco for remediation

  1. Mitigate: Cisco recommends setting up ACLs (access control lists) on intermediary devices that separate the Cisco Unified Communications or Cisco Contact Center Solutions cluster from users and the rest of the network to allow access only to the ports of deployed services.
  2. Harden: These guides list best practices that can help protect your Cisco solutions by listing the security features available and recommended configuration.

Chapter: Operating System and Security Hardening - Contains sections on the security features within, audit logs, determining policy, etc.

Chapter: Unified Contact Center Security Wizard - Contains sections on Cisco's security wizard, Firewall configuration, SQL Hardening, etc.

Associated Bulletins

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm

https://nvd.nist.gov/vuln/detail/CVE-2023-20253

https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-rce-flaw-in-communications-software/

Resources

Trending Articles & Security Reports

Resources

CyberWatch

November 22, 2024

Patch Updates, New Malware Threats, and the Ongoing Supply Chain Battle

On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.

Find out more
October 25, 2024

Ransomware, Supply Chain Attacks, and Nation-State Threats

CyberWatch, by Access Point Consulting, is your weekly source for emerging cybersecurity news, regulatory updates, and threat intelligence. Backed by experts in security consulting, regulatory compliance, and security operations, Access Point enables you to manage cyber risks, respond to incidents, and drive innovation in your company. Read here or on our website; listen on Spotify or Apple Podcasts; or watch on YouTube.website; listen on Spotify or Apple Podcasts; or watch on YouTube. .

Find out more
October 7, 2024

VINs and Losses: How Hackers Take Kias for a Ride

In the age of smart cars and connected devices, convenience often comes with hidden risks. A recently discovered critical vulnerability in Kia vehicles serves as a stark reminder of how our increasingly digital world is making cars new targets for cyberattacks. This vulnerability allowed hackers to remotely control various vehicle functions—using nothing more than a car's license plate number. It highlights the growing threat of cyberattacks on connected cars and the importance of cybersecurity in the automotive industry.

Find out more