Cisco Fixes High-Risk Vulnerability Impacting Unity Connection Software

Cisco has released software updates to handle a critical security flaw impacting Unity Relationship that could permit an adversary to execute arbitrary instructions on the fundamental process.

Tracked as CVE-2024-20272 (CVSS score: 7.3), the vulnerability is an arbitrary file add bug residing in the web-centered management interface and is the outcome of a absence of authentication in a particular API and poor validation of user-supplied facts.

“An attacker could exploit this vulnerability by uploading arbitrary documents to an afflicted technique,” Cisco said in an advisory introduced Wednesday. “A profitable exploit could make it possible for the attacker to keep malicious data files on the technique, execute arbitrary instructions on the functioning process, and elevate privileges to root.”

The flaw impacts the adhering to versions of Cisco Unity Link. Version 15 is not vulnerable.

• 12.5 and before (Fastened in model 12.5.1.19017-4)
• 14 (Mounted in variation 14..1.14006-5)

Security researcher Maxim Suslov has been credited with getting and reporting the flaw. Cisco can make no point out of the bug becoming exploited in the wild, but it is really encouraged that users update to a set version to mitigate opportunity threats.

Together with the patch for CVE-2024-20272, Cisco has also delivered updates to solve 11 medium-severity vulnerabilities spanning its program, like Identification Expert services Motor, WAP371 Wireless Entry Place, ThousandEyes Organization Agent, and TelePresence Administration Suite (TMS).

Cisco, nevertheless, observed that it does not intend to release a resolve for the command injection bug in WAP371 (CVE-2024-20287, CVSS score: 6.5), stating that the unit has reached stop-of-lifetime (EoL) as of June 2019. It truly is as an alternative recommending shoppers migrate to the Cisco Business 240AC Accessibility Stage.

Discovered this report appealing? Adhere to us on Twitter  and LinkedIn to read far more distinctive content material we submit.

Some parts of this article are sourced from:
thehackernews.com