A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.02929.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Cisco Cisco Unified Contact Center Enterprise affected
Version Status Constraints
N/A affected —
Cisco Cisco Unity Connection affected
Version Status Constraints
12.0(1)SU1 affected —
12.0(1)SU2 affected —
12.0(1)SU3 affected —
12.0(1)SU4 affected —
12.0(1)SU5 affected —
12.5(1) affected —
12.5(1)SU1 affected —
12.5(1)SU2 affected —
12.5(1)SU3 affected —
12.5(1)SU4 affected —
12.5(1)SU5 affected —
12.5(1)SU6 affected —
12.5(1)SU7 affected —
14 affected —
14SU1 affected —
14SU2 affected —
Cisco Cisco Unified Communications Manager affected
Version Status Constraints
12.0(1)SU1 affected —
12.0(1)SU2 affected —
12.0(1)SU3 affected —
12.0(1)SU4 affected —
12.0(1)SU5 affected —
12.5(1) affected —
12.5(1)SU1 affected —
12.5(1)SU2 affected —
12.5(1)SU3 affected —
12.5(1)SU4 affected —
12.5(1)SU5 affected —
12.5(1)SU6 affected —
12.5(1)SU7 affected —
12.5(1)SU7a affected —
14 affected —
14SU1 affected —
14SU2 affected —
Cisco Cisco Unified Contact Center Express affected
Version Status Constraints
8.5(1) affected —
9.0(2)SU3ES04 affected —
10.0(1)SU1 affected —
10.0(1)SU1ES04 affected —
10.5(1) affected —
10.5(1)SU1 affected —
10.5(1)SU1ES10 affected —
10.6(1) affected —
10.6(1)SU1 affected —
10.6(1)SU3 affected —
10.6(1)SU2 affected —
10.6(1)SU3ES03 affected —
10.6(1)SU2ES04 affected —
10.6(1)SU3ES02 affected —
10.6(1)SU3ES01 affected —
11.0(1)SU1 affected —
11.0(1)SU1ES03 affected —
11.0(1)SU1ES02 affected —
11.5(1)SU1 affected —
11.5(1)SU1ES02 affected —
11.5(1)SU1ES01 affected —
11.5(1)SU1ES03 affected —
11.5(1)ES01 affected —
12.0(1) affected —
12.0(1)ES01 affected —
12.0(1)ES03 affected —
12.0(1)ES04 affected —
12.0(1)ES02 affected —
12.5(1) affected —
12.5(1)SU1 affected —
12.5(1)SU2 affected —
12.5(1)SU3 affected —
12.5(1)_SU01_ES03 affected —
12.5(1)ES03 affected —
12.5(1)_SU01_ES01 affected —
12.5(1)_SU02_ES02 affected —
12.5(1)_SU01_ES02 affected —
12.5(1)_SU02_ES03 affected —
12.5(1)ES01 affected —
12.5(1)_SU02_ES01 affected —
12.5(1)ES02 affected —
12.5(1)_SU03_ES01 affected —
12.5(1)_SU02_ES04 affected —
12.5(1)_SU03_ES02 affected —
12.5(1)_SU03_ES03 affected —
12.5(1)_SU03_ES04 affected —
11.6(1) affected —
11.6(2) affected —
11.6(1)ES01 affected —
11.6(2)ES06 affected —
11.6(1)ES02 affected —
11.6(2)ES01 affected —
11.6(2)ES03 affected —
11.6(2)ES07 affected —
11.6(2)ES08 affected —
11.6(2)ES02 affected —
11.6(2)ES05 affected —
11.6(2)ES04 affected —
Cisco Cisco Unified Communications Manager IM and Presence Service affected
Version Status Constraints
10.5(1) affected —
10.5(2) affected —
10.5(2a) affected —
10.5(2b) affected —
10.5(2)SU3 affected —
10.5(2)SU2a affected —
10.5(2)SU4a affected —
10.5(2)SU4 affected —
10.5(1)SU3 affected —
10.5(1)SU1 affected —
10.5(2)SU1 affected —
10.5(2)SU2 affected —
10.5(1)SU2 affected —
11.5(1) affected —
11.5(1)SU1 affected —
11.5(1)SU2 affected —
11.5(1)SU3 affected —
11.5(1)SU3a affected —
11.5(1)SU4 affected —
11.5(1)SU5 affected —
11.5(1)SU5a affected —
11.5(1)SU6 affected —
11.5(1)SU7 affected —
11.5(1)SU8 affected —
11.5(1)SU9 affected —
11.5(1)SU10 affected —
11.5(1)SU11 affected —
11.0(1) affected —
11.0(1)SU1 affected —
12.5(1) affected —
12.5(1)SU1 affected —
12.5(1)SU2 affected —
12.5(1)SU3 affected —
12.5(1)SU4 affected —
12.5(1)SU5 affected —
12.5(1)SU6 affected —
12.5(1)SU7 affected —
14 affected —
14SU1 affected —
14SU2 affected —
14SU2a affected —
10.0(1) affected —
10.0(1)SU1 affected —
10.0(1)SU2 affected —
Cisco Cisco Virtualized Voice Browser affected
Version Status Constraints
11.0(1) affected —
11.5(1) affected —
11.5(1)ES29 affected —
11.5(1)ES32 affected —
11.5(1)_ES43 affected —
11.5(1)_ES54 affected —
11.5(1)_ES27 affected —
11.5(1)ES36 affected —
11.5(1)_ES32 affected —
11.5(1)_ES29 affected —
11.5(1)_ES36 affected —
11.5(1)ES43 affected —
11.5(1)_ES53 affected —
11.5(1)ES27 affected —
11.6(1) affected —
11.6(1)_ES82 affected —
11.6(1)_ES22 affected —
11.6(1)_ES81 affected —
11.6(1)_ES87 affected —
11.6(1)_ES84 affected —
11.6(1)_ES85 affected —
11.6(1)_ES83 affected —
11.6(1)_ES80 affected —
11.6(1)_ES86 affected —
11.6(1)_ES88 affected —
12.5(1)_ES04 affected —
12.5(1)_ES07 affected —
12.5(1)_ES02 affected —
12.5(1) affected —
12.5(1)_ES08 affected —
12.5(1)_ES03 affected —
12.5(1)_ES06 affected —
12.5(1)_ES09 affected —
12.5(1)_ES14 affected —
12.5(1)SU affected —
12.5(1)_ES15 affected —
12.5(1)_SU affected —
12.5(1)_SU_ES01 affected —
12.5(1)_ES11 affected —
12.5(1)_ES12 affected —
12.5(2)_ET affected —
12.5(1)_SU_ES02 affected —
12.5(1)_ES10 affected —
12.0(1) affected —
12.0(1)_ES02 affected —
12.0(1)_ES01 affected —
12.0(1)_ES06 affected —
12.0(1)_ES07 affected —
12.0(1)_ES05 affected —
12.0(1)_ES04 affected —
12.0(1)_ES03 affected —
12.0(1)_ES08 affected —
12.6(1) affected —
12.6(1)_ES04 affected —
12.6(1)_ES03 affected —
12.6(1)_ES09 affected —
12.6(1)_ES06 affected —
12.6(1)_ES08 affected —
12.6(1)_ES05 affected —
12.6(2)_ES03 affected —
12.6(1)_ES02 affected —
12.6(1)_ES01 affected —
12.6(2) affected —
12.6(2)_ET01 affected —
12.6(2)_ES02 affected —
12.6(2)_ES01 affected —
12.6(1)_ES07 affected —
Cisco Cisco Packaged Contact Center Enterprise affected
Version Status Constraints
10.5(1) affected —
10.5(2) affected —
10.5(1)_ES7 affected —
10.5(2)_ES8 affected —
11.0(1) affected —
11.0(2) affected —
11.5(1) affected —
11.6(1) affected —
11.6(2) affected —
12.0(1) affected —
12.5(1) affected —
12.5(2) affected —
12.6(1) affected —
12.6(2) affected —
Cisco Cisco Unified Communications Manager / Cisco Unity Connection affected
Version Status Constraints
10.5(2)SU10 affected —
10.5(1) affected —
10.5(1)SU1 affected —
10.5(1)SU1a affected —
10.5(2) affected —
10.5(2)SU1 affected —
10.5(2)SU2 affected —
10.5(2)SU3 affected —
10.5(2)SU4 affected —
10.5(2)SU5 affected —
10.5(2)SU6 affected —
10.5(2)SU7 affected —
10.5(2)SU8 affected —
10.5(2)SU9 affected —
10.5(2)SU2a affected —
10.5(2)SU3a affected —
10.5(2)SU4a affected —
10.5(2)SU6a affected —
11.0(1) affected —
11.0(1a) affected —
11.0(1a)SU1 affected —
11.0(1a)SU2 affected —
11.0(1a)SU3 affected —
11.0(1a)SU3a affected —
11.0(1a)SU4 affected —
11.0.1 affected —
11.0.2 affected —
11.0.5 affected —
11.5(1) affected —
11.5(1)SU1 affected —
11.5(1)SU2 affected —
11.5(1)SU3 affected —
11.5(1)SU3a affected —
11.5(1)SU3b affected —
11.5(1)SU4 affected —
11.5(1)SU5 affected —
11.5(1)SU6 affected —
11.5(1)SU7 affected —
11.5(1)SU8 affected —
11.5(1)SU9 affected —
11.5(1)SU10 affected —
11.5(1)SU11 affected —
10.0(1)SU2 affected —
10.0(1) affected —
10.0(1)SU1 affected —

Configuration 1 [-]

OR cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*

Configuration 5 [-]

cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):-:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:cisco:virtualized_voice_browser:12.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:virtualized_voice_browser:12.6\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:virtualized_voice_browser:12.6\(2\):*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Cisco Subscribe
Unified Communications Manager Subscribe
Unified Communications Manager Im And Presence Service Subscribe
Unified Contact Center Express Subscribe
Unity Connection Subscribe
Virtualized Voice Browser Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2024-17968 A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm cve-icon cve-icon
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.03027}

 epss

{'score': 0.03108}

Thu, 29 May 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2025-05-29T15:12:21.257Z

Reserved: 2023-11-08T15:08:07.622Z

Link: CVE-2024-20253

cve-icon Vulnrichment

Updated: 2024-08-01T21:52:31.560Z

cve-icon NVD

Status : Modified

Published: 2024-01-26T18:15:10.970

Modified: 2025-05-29T16:15:33.330

Link: CVE-2024-20253

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses