2024-015: Remote Code Execution Vulnerability in Cisco Products

2024-015: Remote Code Execution Vulnerability in Cisco Products ↗ source

January 29, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-015/

Summary

This vulnerability, tracked as CVE-2024-20253 with a CVSS score of 9.9, could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. Currently, Cisco has no evidence of public proof of concept exploits for this vulnerability or active exploitation in the wild. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-20253	9.9 Critical	Cisco Cisco Unified Contact Center Enterprise A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to exe…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Cisco 99 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.