Mitigation Instructions for CVE-2024-20253

SUBJECT: Unauthenticated Remote Code Execution in Cisco Unified Communications

TECH STACK: Cisco Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM SME, UCCX, Unity Connection, VVB

DATE(S) ISSUED: 01/24/2024

NVD Last Modified:  01/25/2024

CRITICALITY:  CRITICAL (CVSS Score: 9.9) - This vulnerability poses an extremely high risk of compromise for affected systems. Immediate action is required.

OVERVIEW: 

CVE-2024-20253 is a critical vulnerability in Cisco Unified Communications and Contact Center Solutions products that allows unauthenticated remote attackers to execute arbitrary code on affected devices. This means an attacker could potentially take complete control of your system including:

1.  Stealing sensitive data (emails, call recordings, customer information)
2. Installing malware and ransomware
3. Disrupting or disabling critical business operations
4. Launching further attacks against your network

AFFECTED PRODUCTS:

1. Unified Communications Manager (Unified CM) (all versions)
2. Unified Communications Manager IM&P (all versions)
3. Unified Communications Manager Session Management Edition (Unified CM SME) (all versions)
4. Unified Contact Center Express (UCCX) (all versions)
5. Unity Connection (all versions)
6. Virtualized Voice Browser (VVB) (all versions)

ADDITIONAL PRODUCTS NOT AFFECTED:

1. Customer Collaboration Portal (CCP), formerly SocialMiner
2. Customer Voice Portal (CVP)
3. Emergency Responder (CER)
4. Finesse
5. Hosted Collaboration Mediation Fulfillment (HCM-F)
6. Packaged Contact Center Enterprise (PCCE)
7. Prime Collaboration Deployment (PCD)
8. Prime License Manager (PLM)
9. Remote Expert Mobile
10. Unified Contact Center Domain Manager (CCDM)
11. Unified Contact Center Enterprise (UCCE)
12. Unified Contact Center Management Portal (Unified CCMP)
13. Unified Intelligence Center (CUIC)

SOLUTION

1. Apply Cisco software updates immediately: Patching is the only definitive way to mitigate this vulnerability. Download and install the relevant updates according to your specific product and version from the Cisco Security Advisory: https://www.hkcert.org/security-bulletin/cisco-unity-connection-remote-code-execution-vulnerability_20240112
2. Consider access control lists (ACLs): While not a complete solution, implementing ACLs on intermediary devices can restrict access to vulnerable ports and provide an additional layer of defense. Refer to the Cisco Unified Communications Manager TCP and UDP Port Usage document for detailed guidance.

ADDITIONAL RECOMMENDATIONS:

1. Follow best practices for securing Cisco Unified Communications and Contact Center Solutions outlined in the relevant Cisco Security Guides.
2. Regularly review and update Cisco software to stay protected against newly discovered vulnerabilities.
3. Monitor your systems for suspicious activity and implement intrusion detection/prevention systems.
4. Have a comprehensive incident response plan in place to address potential security breaches.

HANDS ON CONSULTATION: 

If you would like additional hands on remediation instruction feel free to reach out to support@cyrisk.com or fill out the form below. We welcome the opportunity to become an extension of your team. 

Third Party Advisories:

1. Cisco Security Advisory
2. CVE Record
3.  Cisco Unified Communications Manager TCP and UDP Port Usage Overview
4. Security Guide for Cisco Unified Communications Manager

CONFIRMATION & ADDITIONAL INFORMATION:

This vulnerability poses a significant risk to your organization. Take immediate action to patch your systems and implement additional security measures.