Article Details
Scrape Timestamp (UTC): 2024-01-11 04:58:16.036
Source: https://thehackernews.com/2024/01/cisco-fixes-high-risk-vulnerability.html
Original Article Text
Click to Toggle View
Cisco Fixes High-Risk Vulnerability Impacting Unity Connection Software. Cisco has released software updates to address a critical security flaw impacting Unity Connection that could permit an adversary to execute arbitrary commands on the underlying system. Tracked as CVE-2024-20272 (CVSS score: 7.3), the vulnerability is an arbitrary file upload bug residing in the web-based management interface and is the result of a lack of authentication in a specific API and improper validation of user-supplied data. "An attacker could exploit this vulnerability by uploading arbitrary files to an affected system," Cisco said in an advisory released Wednesday. "A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root." The flaw impacts the following versions of Cisco Unity Connection. Version 15 is not vulnerable. Security researcher Maxim Suslov has been credited with discovering and reporting the flaw. Cisco makes no mention of the bug being exploited in the wild, but it's advised that users update to a fixed version to mitigate potential threats. Alongside the patch for CVE-2024-20272, Cisco has also shipped updates to resolve 11 medium-severity vulnerabilities spanning its software, including Identity Services Engine, WAP371 Wireless Access Point, ThousandEyes Enterprise Agent, and TelePresence Management Suite (TMS). Cisco, however, noted that it does not intend to release a fix for the command injection bug in WAP371 (CVE-2024-20287, CVSS score: 6.5), stating that the device has reached end-of-life (EoL) as of June 2019. It's instead recommending customers migrate to the Cisco Business 240AC Access Point. The Ultimate Enterprise Browser Checklist Download a Concrete and Actionable Checklist for Finding a Browser Security Platform. Master Cloud Security - Get FREE eBook Comprehensive eBook covering cloud security across infrastructure, containers, and runtime environments for security professionals
Daily Brief Summary
Cisco has released updates for a high-risk vulnerability in Unity Connection software, which allowed for arbitrary command execution.
The flaw, designated CVE-2024-20272 with a CVSS score of 7.3, was an arbitrary file upload vulnerability in the web management interface.
Security researcher Maxim Suslov identified the vulnerability that resulted from improper API authentication and user data validation.
Although there have been no reports of active exploitation, users are urged to update their systems to protect against potential threats.
The flaw affects several versions of Cisco Unity Connection, barring the non-vulnerable Version 15.
In addition to CVE-2024-20272, Cisco patched 11 other medium-severity issues affecting various software products, but will not update the EoL WAP371 device for its separate command injection bug.
Customers using the WAP371 Wireless Access Point, which has a command injection vulnerability (CVE-2024-20287), are advised to migrate to a newer device since it won't receive a fix due to its end-of-life status.