Main Vulnerability Database Vulnerabilities #VU85776

Deserialization of Untrusted Data in Cisco Systems, Inc products - CVE-2024-20253

Published: January 24, 2024

Vulnerability identifier: #VU85776

CSH Severity: High

CVSS v4 BT: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-20253

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can send a specially crafted message to a listening port of an affected device and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Cisco Unified Communications Manager IM & Presence Service
Cisco Unified Communications Manager Session Management Edition
Cisco Unified Communications Manager
Cisco Unified Contact Center Express
Cisco Unified Contact Center Enterprise
Cisco Unity Connection
Cisco Packaged Contact Center Enterprise
Cisco Virtualized Voice Browser

How to mitigate CVE-2024-20253

Install updates from vendor's website.

External References

Related Security Bulletins