CVE-2024-20253

It’s a security hole in Cisco call/voice and contact-center systems that allows a remote attacker to run commands on the server without any login. Think of it like leaving a “no-password” back door to the building and letting someone not only enter, but also change what the system does. In the worst case, attackers can take full control and disrupt your voice/call services.

This matters if your business runs any of the listed Cisco Unified Communications and Contact Center products (for example, your phone/call-routing system, voicemail, and related contact-center components). The vulnerability can be triggered remotely by a network attacker without authentication, and no user action is needed. Prioritize patching especially if your systems are reachable from the internet or otherwise exposed to untrusted networks/traffic on their listening interfaces.

This is RED because attackers are already exploiting the vulnerability in the wild. Exploitation has been reported to create files on targeted devices using crafted payloads, meaning systems with exposed network access are at immediate risk. Patch without delay and lock down network reachability of the affected interfaces until you’re upgraded.

Confirm whether you’re exposed

1. For each Cisco product instance you operate, confirm the exact product name and software version.
2. Match your product/version to what you’re running against the affected product list provided (unified communications manager, unified communications manager im and presence service, unity connection, unified contact center enterprise/express, and virtualized voice browser).
3. If any of the following are present, plan an upgrade immediately: unified communications manager, unified communications manager im and presence service, unity connection.

Apply the fix

4. Upgrade the affected components to the fixed release:
   • unified communications manager → 12.5(1)su8
   • unified communications manager im and presence service → 12.5(1)su8
   • unity connection → 12.5(1)su8
5. Follow Cisco’s upgrade procedure for your version-to-12.5(1)su8 path (including any required reboots and configuration compatibility steps).

If patching is delayed (temporary workaround)

6. Restrict access to the affected systems so untrusted users/hosts cannot reach the “listening ports” from the internet or other non-trusted networks.
7. Ensure firewall rules only allow required traffic sources (e.g., your internal management networks or specific partner IPs), and block all other inbound connectivity.

Post-upgrade validation

8. Verify the services are healthy after upgrade (startup, call-routing/connectivity, voicemail/UC functions as applicable).
9. Review logs for suspicious activity tied to the exploitation pattern described in reporting (unexpected file creation and payload handling).
10. Continue monitoring for unusual processes or continued indicators of compromise until you have high confidence no malicious payloads were executed.

KEV / timelines

• This issue is not listed in CISA KEV according to the provided findings; however, exploitation has been reported and is active, so treat it as urgent regardless.

Severity is critical in practice due to unauthenticated remote code execution and potential escalation to root. The mechanism is improper processing of attacker-controlled data in the products’ handling of network input; an attacker sends a specially crafted message to a listening interface, resulting in arbitrary command execution on the underlying operating system with the web services user’s privileges, with potential root access thereafter. Exploitation is reported as occurring in the wild, and public exploit code is available, indicating mature attack tooling. KEV is not listed, so the urgency here is driven by reported exploitation rather than KEV inclusion. (EPSS is provided as a low predicted likelihood in the findings, but real-world exploitation overrides prediction for prioritization.)