Skip to main content

Unity Connection CVE-2024-20272

CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2024-01-17 psirt@cisco.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jan 17, 2024 - 17:15 nvd
CRITICAL 9.8

DescriptionNVD

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.

AnalysisAI

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root. Affected products include: Cisco Unity Connection.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

CVE-2026-20045 HIGH
8.2 Jan 21

Cisco Unified Communications Manager and related products contain a code injection vulnerability (CVE-2026-20045) that a

CVE-2017-12337 CRITICAL
9.8 Nov 16

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System softw

CVE-2015-6360 HIGH
7.5 Apr 21

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via

CVE-2024-20253 CRITICAL
10.0 Jan 26

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenti

CVE-2014-3333 CRITICAL
9.0 Aug 11

The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by

CVE-2012-0366 CRITICAL
9.0 Mar 01

Cisco Unity Connection before 7.1.3b(Su2) allows remote authenticated users to change the administrative password by lev

CVE-2022-20859 HIGH
8.8 Jul 06

A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified C

CVE-2021-1362 HIGH
8.8 Apr 08

A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager S

CVE-2012-0367 HIGH
7.8 Mar 01

Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers t

CVE-2012-3060 HIGH
7.8 Sep 16

Cisco Unity Connection (UC) 8.6, 9.0, and 9.5 allows remote attackers to cause a denial of service (CPU consumption) via

CVE-2023-20259 HIGH
7.5 Oct 04

A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, rem

CVE-2023-20266 HIGH
7.2 Aug 30

A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communica

Share

CVE-2024-20272 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy