Cisco warns of critical RCE flaw in communications software

Cisco has published an advisory for CVE-2024-20253, a critical (CVSS 9.9) unauthenticated remote code execution vulnerability in multiple Unified Communications Manager and Contact Center product versions; the flaw can allow arbitrary code execution and potential root access. Cisco provides specific patched releases for each affected product, states there is no workaround (recommends applying updates), suggests ACLs as a mitigation until patches are applied, and reports no evidence of public exploitation to date.