CVE-2024-20253

State: Published
Severity: 9.9 Critical
Published: Jan 26, 2024
Updated: May 29, 2025
Reserved: Nov 8, 2023

Description

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H	cisco

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
Cisco Unified Contact Center EnterpriseCisco	N/AAffected
Cisco Unity ConnectionCisco	12.0(1)SU1Affected 12.0(1)SU2Affected 12.0(1)SU3Affected 12.0(1)SU4Affected 12.0(1)SU5Affected 12.5(1)Affected 12.5(1)SU1Affected 12.5(1)SU2Affected 12.5(1)SU3Affected 12.5(1)SU4Affected 12.5(1)SU5Affected 12.5(1)SU6Affected 12.5(1)SU7Affected 14Affected 14SU1Affected 14SU2Affected
Cisco Unified Communications ManagerCisco	12.0(1)SU1Affected 12.0(1)SU2Affected 12.0(1)SU3Affected 12.0(1)SU4Affected 12.0(1)SU5Affected 12.5(1)Affected 12.5(1)SU1Affected 12.5(1)SU2Affected 12.5(1)SU3Affected 12.5(1)SU4Affected 12.5(1)SU5Affected 12.5(1)SU6Affected 12.5(1)SU7Affected 12.5(1)SU7aAffected 14Affected 14SU1Affected 14SU2Affected
Cisco Unified Contact Center ExpressCisco	8.5(1)Affected 9.0(2)SU3ES04Affected 10.0(1)SU1Affected 10.0(1)SU1ES04Affected 10.5(1)Affected 10.5(1)SU1Affected 10.5(1)SU1ES10Affected 10.6(1)Affected 10.6(1)SU1Affected 10.6(1)SU3Affected 10.6(1)SU2Affected 10.6(1)SU3ES03Affected 10.6(1)SU2ES04Affected 10.6(1)SU3ES02Affected 10.6(1)SU3ES01Affected 11.0(1)SU1Affected 11.0(1)SU1ES03Affected 11.0(1)SU1ES02Affected 11.5(1)SU1Affected 11.5(1)SU1ES02Affected 11.5(1)SU1ES01Affected 11.5(1)SU1ES03Affected 11.5(1)ES01Affected 12.0(1)Affected 12.0(1)ES01Affected and 33 more versions
Cisco Unified Communications Manager IM and Presence ServiceCisco	10.5(1)Affected 10.5(2)Affected 10.5(2a)Affected 10.5(2b)Affected 10.5(2)SU3Affected 10.5(2)SU2aAffected 10.5(2)SU4aAffected 10.5(2)SU4Affected 10.5(1)SU3Affected 10.5(1)SU1Affected 10.5(2)SU1Affected 10.5(2)SU2Affected 10.5(1)SU2Affected 11.5(1)Affected 11.5(1)SU1Affected 11.5(1)SU2Affected 11.5(1)SU3Affected 11.5(1)SU3aAffected 11.5(1)SU4Affected 11.5(1)SU5Affected 11.5(1)SU5aAffected 11.5(1)SU6Affected 11.5(1)SU7Affected 11.5(1)SU8Affected 11.5(1)SU9Affected and 19 more versions
Cisco Virtualized Voice BrowserCisco	11.0(1)Affected 11.5(1)Affected 11.5(1)ES29Affected 11.5(1)ES32Affected 11.5(1)_ES43Affected 11.5(1)_ES54Affected 11.5(1)_ES27Affected 11.5(1)ES36Affected 11.5(1)_ES32Affected 11.5(1)_ES29Affected 11.5(1)_ES36Affected 11.5(1)ES43Affected 11.5(1)_ES53Affected 11.5(1)ES27Affected 11.6(1)Affected 11.6(1)_ES82Affected 11.6(1)_ES22Affected 11.6(1)_ES81Affected 11.6(1)_ES87Affected 11.6(1)_ES84Affected 11.6(1)_ES85Affected 11.6(1)_ES83Affected 11.6(1)_ES80Affected 11.6(1)_ES86Affected 11.6(1)_ES88Affected and 42 more versions
Cisco Packaged Contact Center EnterpriseCisco	10.5(1)Affected 10.5(2)Affected 10.5(1)_ES7Affected 10.5(2)_ES8Affected 11.0(1)Affected 11.0(2)Affected 11.5(1)Affected 11.6(1)Affected 11.6(2)Affected 12.0(1)Affected 12.5(1)Affected 12.5(2)Affected 12.6(1)Affected 12.6(2)Affected
Cisco Unified Communications Manager / Cisco Unity ConnectionCisco	10.5(2)SU10Affected 10.5(1)Affected 10.5(1)SU1Affected 10.5(1)SU1aAffected 10.5(2)Affected 10.5(2)SU1Affected 10.5(2)SU2Affected 10.5(2)SU3Affected 10.5(2)SU4Affected 10.5(2)SU5Affected 10.5(2)SU6Affected 10.5(2)SU7Affected 10.5(2)SU8Affected 10.5(2)SU9Affected 10.5(2)SU2aAffected 10.5(2)SU3aAffected 10.5(2)SU4aAffected 10.5(2)SU6aAffected 11.0(1)Affected 11.0(1a)Affected 11.0(1a)SU1Affected 11.0(1a)SU2Affected 11.0(1a)SU3Affected 11.0(1a)SU3aAffected 11.0(1a)SU4Affected and 20 more versions

References

cisco-sa-cucm-rce-bWNzQcUm

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.