Cisco has addressed a critical vulnerability in its Cisco Unity Connection unified messaging and voicemail product as the year 2024 began.
The CVE-2024-20272 advisory from Cisco outlines that the vulnerability is present in the web management interface of Unity Connection. Discovered by Maxim Suslov, Cisco has stated that there are no known exploits in the wild at this time.
The vulnerability arises from a lack of authentication in a specific API and improper validation of user-supplied data. This flaw allows an attacker to upload arbitrary files to the system and execute operating system commands.
In the event of a successful exploit, an attacker could store malicious files on the system, execute arbitrary commands on the operating system, and potentially elevate privileges to root.
Notably, there is no known workaround for this vulnerability. The impacted versions include Unity Connection version 12.5 and earlier, while version 14 is also affected. Fixed software is available for both branches, with Version 15 confirmed as not vulnerable.
It’s essential to be aware that the fixes are not accessible through the Cisco software download center. Instead, they are released as an “engineering special,” and customers are advised to contact Cisco’s Technical Assistance Centre (TAC) to obtain the necessary fix.