CVE-2024-20272 File upload in Cisco Unity Connection
Unauthenticated remote attackers can upload arbitrary files to Cisco Unity Connection to execute commands and gain root privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-20272?
CVE-2024-20272 is a high-severity vulnerability in Cisco Unity Connection, published on 17 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.
Weakness: CWE-434
Which versions are affected by CVE-2024-20272?
It affects 1 product.
Products include Cisco Unity Connection.
How do I fix CVE-2024-20272?
No fix has been published for CVE-2024-20272 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-20272 being exploited?
There is no known exploitation of CVE-2024-20272 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unity Connection
Sources
Also known as GHSA-vxjc-53hv-3fh8.