CVE-2024-20253

Severity

CRITICAL

CVSS

9.9

EPSS

0.02399

Risk score

40.44

CISA KEV

PoC

Published

2024-01-26

Modified

2025-05-29

First seen

2026-08-07

Aliases

EUVD-2024-17968, GHSA-GXH9-CF3G-3V7F

Products

Cisco:Cisco Packaged Contact Center Enterprise 10.5(2), Cisco:Cisco Packaged Contact Center Enterprise 11.6(2), Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 10.5(1), Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 10.5(2)SU1, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 10.5(2)SU2, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 10.5(2)SU5, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 10.5(2)SU6a, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 11.0(1a), Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 11.0(1a)SU2, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 11.0.2, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 11.0.5, Cisco:Cisco Unified Communications Manager / Cisco Unity Connection 11.5(1)SU8, Cisco:Cisco Unified Communications Manager 12.5(1)SU5, Cisco:Cisco Unified Communications Manager 14SU1, Cisco:Cisco Unified Communications Manager IM and Presence Service 10.5(2), Cisco:Cisco Unified Communications Manager IM and Presence Service 11.0(1), Cisco:Cisco Unified Communications Manager IM and Presence Service 11.5(1)SU3, Cisco:Cisco Unified Communications Manager IM and Presence Service 11.5(1)SU3a, Cisco:Cisco Unified Communications Manager IM and Presence Service 11.5(1)SU5a, Cisco:Cisco Unified Communications Manager IM and Presence Service 12.5(1)SU7, Cisco:Cisco Unified Contact Center Express 10.0(1)SU1, Cisco:Cisco Unified Contact Center Express 10.5(1)SU1ES10, Cisco:Cisco Unified Contact Center Express 10.6(1), Cisco:Cisco Unified Contact Center Express 11.0(1)SU1ES03, Cisco:Cisco Unified Contact Center Express 11.6(1)ES01, Cisco:Cisco Unified Contact Center Express 11.6(2)ES03, Cisco:Cisco Unified Contact Center Express 12.0(1)ES01, Cisco:Cisco Unified Contact Center Express 12.5(1)SU3, Cisco:Cisco Unity Connection 12.0(1)SU1, Cisco:Cisco Unity Connection 12.0(1)SU2, Cisco:Cisco Unity Connection 12.5(1)SU3, Cisco:Cisco Unity Connection 14, Cisco:Cisco Virtualized Voice Browser 11.5(1)ES27, Cisco:Cisco Virtualized Voice Browser 11.5(1)ES32, Cisco:Cisco Virtualized Voice Browser 11.5(1)_ES27, Cisco:Cisco Virtualized Voice Browser 11.5(1)_ES53, Cisco:Cisco Virtualized Voice Browser 11.6(1)_ES81, Cisco:Cisco Virtualized Voice Browser 11.6(1)_ES87, Cisco:Cisco Virtualized Voice Browser 12.0(1)_ES01, Cisco:Cisco Virtualized Voice Browser 12.0(1)_ES03, Cisco:Cisco Virtualized Voice Browser 12.5(1)SU, Cisco:Cisco Virtualized Voice Browser 12.5(1)_ES03, Cisco:Cisco Virtualized Voice Browser 12.5(1)_ES07, Cisco:Cisco Virtualized Voice Browser 12.5(1)_ES10, Cisco:Cisco Virtualized Voice Browser 12.5(1)_ES11, Cisco:Cisco Virtualized Voice Browser 12.5(1)_SU_ES01, Cisco:Cisco Virtualized Voice Browser 12.5(2)_ET, Cisco:Cisco Virtualized Voice Browser 12.6(1), Cisco:Cisco Virtualized Voice Browser 12.6(1)_ES03, Cisco:Cisco Virtualized Voice Browser 12.6(2)_ES01

Sources

euvd EUVD-2024-17968

Description

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.

Description

References