InfoSecBulletin Cybersecurity for mankind
Cisco released updates to fix a security flaw in Unity Connection that could allow an attacker to run commands on the system.
The vulnerability CVE-2024-20272 (CVSS score: 7.3) is an arbitrary file upload bug in the web-based management interface. It happens due to a lack of authentication in a specific API and improper validation of user-supplied data.
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
“An attacker could exploit this vulnerability by uploading arbitrary files to an affected system,” Cisco said in an advisory released Wednesday. “A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.”
The flaw affects some versions of Cisco Unity Connection, but not Version 15.
12.5 and earlier (Fixed in version 12.5.1.19017-4)
14 (Fixed in version 14.0.1.14006-5)
Maxim Suslov, a security researcher, found and reported the bug. Cisco didn’t mention any evidence of the bug being used by attackers, but it’s recommended for users to update to a fixed version to reduce potential risks.
Cisco has fixed 11 medium-severity vulnerabilities in its software, along with the patch for CVE-2024-20272. The affected products include Identity Services Engine, WAP371 Wireless Access Point, ThousandEyes Enterprise Agent, and TelePresence Management Suite (TMS).
Cisco will not fix the command injection bug in WAP371 (CVE-2024-20287, CVSS score: 6.5) because the device reached end-of-life in June 2019. Cisco suggests customers migrate to the Cisco Business 240AC Access Point.
