Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems

Cisco disclosed and patched a critical remote code execution vulnerability (CVE-2024-20253, CVSS 9.9) in multiple Unified Communications and Contact Center Solutions products that could allow an unauthenticated attacker to send specially crafted messages to a listening port, execute arbitrary commands as the web services user, and potentially gain root access; Cisco has released fixes and recommends using access control lists to limit exposure until patches are applied.