How to Protect Your Cisco Unified Communications Products from CVE-2024-20253- A Critical RCE Vulnerability?

Cisco recently published a security advisory detailing a critical  remote code execution  (RCE) vulnerability affecting multiple Cisco Unified Communications products. According to the advisory updated on January 30th, 2024, this vulnerability tracked as CVE-2024-20253 could allow an unauthenticated attacker to achieve arbitrary command execution with root privileges on vulnerable devices.

With a base CVSS score of 9.9 out of 10, this is an extremely critical flaw that enables complete compromise of affected systems. Cisco’s advisory reveals that this vulnerability stems from improper processing of user-supplied data that gets loaded into memory by the web services process. By sending a specially crafted message, a remote attacker could exploit this vulnerability to execute commands directly on the underlying operating system.

Given the severity and ease of exploitability of this flaw, it is crucial for organizations using vulnerable Cisco Unified Communications products to apply the necessary updates. In this blog post, we will summarize the vulnerability details from Cisco’s advisory and examine how you can secure your environment against CVE-2024-20253.

A Short Introduction to Cisco Unified Communications Products

Cisco Unified Communications refers to a portfolio of IP-based voice, video, messaging, and conferencing products offered by Cisco. This includes popular solutions like:

Unified Communications Manager (Unified CM): Also called CallManager, this is the central software component that controls call routing, signaling, registration etc. It provides call control capabilities and manages endpoints like IP phones, softphones, video conferencing equipment etc.

Unified Communications Manager IM and Presence Service: Works along with Unified CM to enable advanced instant messaging, presence, and availability capabilities across an organization’s network.

Unity Connection: A feature-rich voice, integrated messaging, and voicemail solution that interoperates with Unified CM. Users can access voicemails and messages via phone, email, web browser etc.

Unified Contact Center Express (UCCX): An IP-based customer contact center application that integrates self-service abilities with call routing and distribution functionalities.

The core value proposition of Cisco’s Unified Communications platform is to make advanced communication and collaboration possible across distributed networks and a range of devices. Key capabilities offered include call control and routing, consolidated messaging, mobility, web/video conferencing, contact center features etc. Many enterprises deploy Unified Communications products from Cisco as the foundation of their IP telephony and UC environment.

Summary of CVE-2024-20253

  • CVE ID: CVE-2024-20253

  • Description: A remote code execution vulnerability in multiple Cisco Unified Communications products that could allow unauthenticated arbitrary command execution with root privileges.

  • CVSS Score: 9.9

  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

According to Cisco’s advisory, this flaw allows an unauthenticated remote attacker to achieve arbitrary command execution on the underlying operating system of vulnerable devices.

See also  How To Protect Your Windows Computers From DogWalk Path Traversal Vulnerability?

It stems from improper processing of user-supplied data that gets loaded into memory by the web services process in affected versions of Cisco Unified Communications products. By sending a specially crafted message to an open port, an attacker could exploit this vulnerability to execute arbitrary code with the privileges of the web services user account.

With access to the underlying OS, the attacker can then establish root privileges on the system. This would allow the adversary to fully compromise vulnerable servers, intercept calls, exfiltrate data, or launch further attacks on the network.

Given the complete system control achievable through exploiting this remote code execution bug, organizations using impacted Cisco Unified Communications releases must apply the necessary updates urgently.

Products Affected

According to Cisco’s advisory, the following products and versions are affected by this remote code execution vulnerability:

  • Unified Communications Manager (Unified CM) 11.5(1) and 12.5(1)

  • Unified Communications Manager IM & Presence Service (Unified CM IM&P) 11.5(1) and 12.5(1)

  • Unified Communications Manager Session Management Edition (Unified CM SME)

  • Unified Contact Center Express (UCCX) 12.0 and earlier

  • Unity Connection 11.5(1) and 12.5(1)

  • Virtualized Voice Browser (VVB) 12.0 and earlier

So essentially the flaw impacts the core Cisco Unified Communications platforms including Unified CM, IM & Presence, Unity Connection, UCCX as well as Virtualized Voice Browser.

According to the advisory, only the above product versions in their default configuration are vulnerable. Other releases including Unified CM 15.x, Unity Connection 15.x etc are not affected.

Still, given the ubiquitous deployment of these Cisco voice and contact center solutions, businesses need to promptly check if they are running any of the impacted versions listed above in their environment. Applying the necessary updates should be treated as a critical priority.

How to Protect Your Cisco Unified Communications Products from CVE-2024-20253?

Cisco has released software updates for all vulnerable products and versions to address this remote code execution vulnerability.

Administrators of affected environments should upgrade to the fixed versions mentioned in Cisco’s advisory – Unified CM 12.5(1)SU8, Unity Connection 12.5(1)SU8, UCCX 12.5(1), VVB 12.5(1) etc. Alternatively, newer releases like Unified CM 15.x, Unity Connection 15.x that are not vulnerable can also be adopted.

As a temporary workaround, access control lists (ACLs) can be configured on adjacent firewalls and routers to block untrusted traffic to the ports and services used by the Cisco voice products. But this should only serve as an additional layer until patching is completed.

Further, IT teams managing these environments must ensure that platform hardening best practices are followed per Cisco’s security guides for Unified Communications Manager, Contact Center etc. Minimizing the network exposure of voice components is critical.

See also  Step by Step Procedure to Convert a CER Certificate to PFX Without the Private Key

For more information, see the Cisco Unified Communications Manager TCP and UDP Port Usage Overview section of the System Configuration Guide for Cisco Unified Communications Manager, Release 14 and SUs or the version that corresponds with the deployed release, or the latest Port Utilization Guide for Cisco Unified Contact Center Solutions.

Additionally, follow the best practices that are described in the latest Security Guide for Cisco Unified Communications Manager or the latest Security Guide for Cisco Unified ICM/Contact Center Enterprise.

Refer this table to find out the vulnerable and associated fixed release information.

Unified CM and Unified CM SME: CSCwd64245

Cisco Unified CM and Unified CM SME Release
First Fixed Release
11.5(1)
Migrate to a fixed release.
12.5(1)
12.5(1)SU8 or
14
14SU3 or
15
Not vulnerable.

Unified CM IM&P: CSCwd64276

Cisco Unified CM IM&P Release
First Fixed Release
11.5(1)
Migrate to a fixed release.
12.5(1)
12.5(1)SU8 or
14
14SU3 or
15
Not vulnerable.

Unity Connection: CSCwd64292

Cisco Unity Connection Release
First Fixed Release
11.5(1)
Migrate to a fixed release.
12.5(1)
12.5(1)SU8 or
14
14SU3 or
15
Not vulnerable.

UCCX: CSCwe18773

Cisco UCCX Release
First Fixed Release
12.0 and earlier
Migrate to a fixed release.
12.5(1)
15
Not vulnerable.

VVB: CSCwe18840

Cisco VVB Release
First Fixed Release
12.0 and earlier.
Migrate to a fixed release.
12.5(1)
12.6(1) and 12.6(2)
15
Not vulnerable.

Procedure to Upgrade Cisco Unified Communications Products?

Upgrade Preparation

  1. Inventory and Compatibility:

  2. Backup and Disaster Recovery:

    • Perform full backups of all UC components before starting.

    • Have a rollback plan in case of upgrade failure.

  3. COP Files:

    • Check if specific COP (Cisco Options Package) files are required to enable features or increase disk space. Download these in advance from the Cisco Software Download Center portal.

  4. Obtain Upgrade Software:

     

Upgrade Methods

Cisco supports two primary upgrade methods:

  • Direct Upgrade: Upgrades an existing system to a newer version, preserving most of your configurations.

  • Migration: Builds a new system with the newer version and migrates data and settings from the old system. Migrations are typically used when a direct upgrade path is not available or for significant hardware changes.

General Upgrade Process (Direct Upgrade Example)

  1. Install COP Files (if required): Follow Cisco’s instructions for installing any necessary COP files.

  2. Upgrade Readiness: Run pre-upgrade checks and tools recommended by Cisco.

  3. Upgrade CUCM:

    • Begin with the Publisher node in a cluster.

    • Follow the instructions in the Cisco Upgrade Guide for the specific version.

  4. Upgrade Subscribers: Upgrade subscriber nodes in the cluster.

  5. Upgrade Other UC Products: Follow similar processes for IM and Presence Service, Cisco Unity Connection, and other components.

  6. Post-Upgrade Verification: Thoroughly test all functionalities: call routing, voice quality, messaging, presence, etc.

Important Considerations

  • Complexity and Downtime The complexity of the upgrade depends on the size of your deployment, customizations, and specific upgrade path. Plan for potential downtime during the process.

  • Licensing: Ensure you have the correct licenses for the upgraded versions.

  • Hardware: Verify hardware compatibility and plan for hardware upgrades if necessary.

  • Professional Assistance: For complex environments or if you lack in-house expertise, consider partnering with a Cisco certified partner.

Check out these additional resources before proceeding upgrades.

Disclaimer: Don’t depend on this upgradation tips. We are not the official support team. Always refer the instructions in Cisco’s official documentation for your specific upgrade scenario.

Bottom Line

No organization can afford to ignore a critical remote code execution vulnerability like CVE-2024-20253 affecting Cisco Unified Communications systems, used widely across enterprises and even cloud/service providers. Such flaws that permit unauthenticated  arbitrary code execution  with root permissions could enable adversaries to fully compromise affected servers using just an unprotected network path.

Cisco has provided the necessary software updates to mitigate this vulnerability for all impacted voice and contact center product versions. Administrators using these releases must treat upgrading to the fixed versions as an extremely urgent priority to safeguard operations. The steps to upgrade Cisco Unified Communications components safely have been outlined. Proactive patching, following security best practices and applying defense-in-depth with access restrictions can help ensure your organization’s communication systems are resilient against attacks targeting such security flaws.

Leave a Reply

Your email address will not be published. Required fields are marked *