Critical RCE flaw detected in Cisco’s communication software

Cisco warns that some Unified Communications Manager and Contact Center Solutions products have a critical remote code execution security vulnerability.

Cisco’s Unified Communications and Contact Center Solutions offer voice, video, and messaging services, as well as customer engagement and management.

• Cyber Attack
• International
• Social media
• Vulnerabilities

“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records

By infosecbulletin / Thursday , November 21 2024

Renowned cybersecurity researcher Jeremiah Fowler uncovered a non-password-protected database having over 1.1 million records linked to Conduitor Limited (Forces Penpals)....

Read More

• Alert
• Vulnerabilities

CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE

By infosecbulletin / Wednesday , November 20 2024

Trend Micro released a security update for Deep Security 20 Agent Manual Scan Command Injection RCE Vulnerability (CVE-2024-51503) that resolves...

Read More

• Alert
• Vulnerabilities

Apple Releases Patch for two Actively Exploited Zero-Day

By infosecbulletin / Wednesday , November 20 2024

Apple released critical updates for its various products including for iOS, iPadOS, macOS, visionOS, and Safari to fix two zero-day...

Read More

• Uncategorized

Maxar Space Data Leak, Company admit, Investigation ongoing!

By infosecbulletin / Tuesday , November 19 2024

Maxar Space Systems has verified a major data breach that exposed particular information of current and former workers. The breach...

Read More

• Uncategorized

GitHub CLI Vulnerability Could Allow RCE

By infosecbulletin / Tuesday , November 19 2024

A security vulnerability (CVE-2024-52308) in the GitHub Command Line Interface (CLI) could allow remote code execution on users' devices. With...

Read More

• Cyber Attack
• Data Breach
• Hot Topic
• National
• Vulnerabilities

“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data

By infosecbulletin / Tuesday , November 19 2024

“Sarcoma” ransomware group attacked a well known Bangladeshi insurance company named "Popular life insurance company ltd". The threat actor keeps...

Read More

• Event
• National

BugHunt 2024: A Milestone Cyber security Competition held at Dhaka

By infosecbulletin / Monday , November 18 2024

Bug Hunt 2024, one of the largest cyber security competitions and conferences in Bangladesh, was successfully held at the ICT...

Read More

• Vulnerabilities

TP-Link DHCP Vulnerability Allow Attackers Takeover Routers Remotely

By infosecbulletin / Saturday , November 16 2024

A serious security flaw has been found in some TP-Link routers, potentially enabling hackers to remotely access the affected devices.The...

Read More

• Cyber Attack
• Hot Topic
• International
• Vulnerabilities

WSJ reports
T-Mobile hacked in massive breach of telecom networks

By infosecbulletin / Saturday , November 16 2024

The Wall Street Journal reported on Friday citing people familiar with the matter that T-Mobile’s network was among the systems...

Read More

• Alert
• Cyber Attack
• Hot Topic
• International
• Vulnerabilities

Palo Alto Networks Confirms critical RCE zero-day actively exploited

By infosecbulletin / Friday , November 15 2024

"Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall...

Read More

The company issued a security bulletin about a vulnerability (CVE-2024-20253) that could let an unauthorized remote attacker run code on a device.

Researcher Julien Egloff from Synacktiv discovered a vulnerability with a 9.9 base score out of 10. The vulnerability is due to incorrect handling of user-input data stored in memory.

Attackers can exploit this vulnerability by sending a carefully designed message to a specific port. This can allow them to execute any command using the web services user’s privileges and gain root access.

CVE-2024-20253 impacts the following Cisco products in their default configurations:

Packaged Contact Center Enterprise (PCCE) versions 12.0 and earlier, 12.5(1) and 12.5(2)
Unified Communications Manager (Unified CM) versions 11.5, 12.5(1), and 14. (same for Unified CM SME)
Unified Communications Manager IM & Presence Service (Unified CM IM&P) versions 11.5(1), 12.5(1), and 14.
Unified Contact Center Enterprise (UCCE) versions 12.0 and earlier, 12.5(1), and 12.5(2).
Unified Contact Center Express (UCCX) versions 12.0 and earlier and 12.5(1).
Unity Connection versions 11.5(1), 12.5(1), and 14.
Virtualized Voice Browser (VVB) versions 12.0 and earlier, 12.5(1), and 12.5(2).

The vendor says there’s no other solution and advises applying the security updates. The updates fix the critical remote code execution (RCE) flaw.

PCCE: 12.5(1) and 12.5(2) apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn.
Unified CM and Unified CME: 12.5(1)SU8 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512. 14SU3 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512.
Unified CM IM&P: 12.5(1)SU8 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512. 14SU3 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512.
UCCE: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).
UCCX: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1).
VVB: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).

Cisco recommends using access control lists (ACLs) as a mitigation strategy when applying updates is not immediately feasible.