Cisco says critical Unity Connection bug lets attackers get root

Cisco patched a critical unauthenticated command-execution flaw (CVE-2024-20272) in Unity Connection's web management interface that could allow attackers to upload files, execute OS commands, and gain root privileges; Cisco reports no evidence of public proof-of-concept or active exploitation. The advisory also covers a PoC-backed command injection (CVE-2024-20287) in the WAP371 access point that can yield root command execution but requires admin credentials, and Cisco will not issue a firmware patch for the EOL WAP371, advising migration to newer hardware.