Cisco Unified Communications Flaw Let Attackers Execute Arbitrary Code

Cisco published an advisory for CVE-2024-20253 describing a critical unauthenticated remote code execution vulnerability in several Unified Communications and Contact Center products that could allow arbitrary command execution as the web services user and potentially lead to root access. Cisco has released software updates to address the issue, advises ACL-based mitigation (no full workarounds), credits the reporter, and states there is no known public exploitation to date.