Cisco fixed critical Unity Connection vulnerability CVE-2024-20272
January 11, 2024
Cisco addressed a critical Unity Connection security flaw that can be exploited by an unauthenticated attacker to get root privileges.
Cisco has addressed a critical flaw, tracked as CVE-2024-20272, in its Unity Connection that can be exploited by a remote, unauthenticated attacker to gain root privileges on vulnerable devices.
Cisco Unity Connection is a messaging platform and voicemail system that is part of the Cisco Unified Communications suite of products.
The vulnerability resides in the web-based management interface of Cisco Unity Connection. A remote, unauthenticated attacker can exploit the issue to upload arbitrary files to an affected system and execute commands on the underlying operating system.
“This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.” reads the advisory published by the IT giant.
Cisco’s advisory states that there are no workarounds that address this vulnerability and urges customers to install security patches to fix the bug.
The following table reports the fixed software release.
| Cisco Unity Connection Release | First Fixed Release |
|---|---|
| 12.5 and earlier | 12.5.1.19017-41 |
| 14 | 14.0.1.14006-51 |
| 15 | Not vulnerable |
The Cisco PSIRT is not aware of attacks in the wild exploiting this vulnerability.
Cisco credited Maxim Suslov for discovering this vulnerability.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Cisco)