CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
53.0%
According to its self-reported version, Cisco Unified Communications Manager running on the report host is affected by a remote code execution (RCE) vulnerability. Due to improper processing of user-provided data that is being read into memory, an unauthenticated, remote, attacker can execute arbitrary code with the privileges of the web services users.
With access to the underlying operating system, the attacker could also establish root access on the affected device.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(189531);
script_version("1.2");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/02/02");
script_cve_id("CVE-2024-20253");
script_xref(name:"CISCO-BUG-ID", value:"CSCwd64245");
script_xref(name:"CISCO-SA", value:"cisco-sa-cucm-rce-bWNzQcUm");
script_xref(name:"IAVA", value:"2024-A-0056");
script_name(english:"Cisco Unified Communications Manager RCE (cisco-sa-cucm-rce-bWNzQcUm)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Unified Communications Manager running on the report host is affected by
a remote code execution (RCE) vulnerability. Due to improper processing of user-provided data that is being read into
memory, an unauthenticated, remote, attacker can execute arbitrary code with the privileges of the web services users.
With access to the underlying operating system, the attacker could also establish root access on the affected device.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
# https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4341e9c8");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd64245");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwd64245");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20253");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/24");
script_set_attribute(attribute:"patch_publication_date", value:"2024/01/24");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/01/25");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_communications_manager");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_ucm_detect.nbin");
script_require_keys("Host/Cisco/CUCM/Version", "Host/Cisco/CUCM/Version_Display");
exit(0);
}
include('ccf.inc');
var product_info = cisco::get_product_info(name:'Cisco Unified Communications Manager');
var version_active = get_kb_item('Host/Cisco/show_version_active');
if ('CSCwd64245' >< version_active)
audit(AUDIT_HOST_NOT, 'affected due to presence of hotfix');
var fix;
if (product_info['version'] =~ "^14\.")
fix = '14SU3 or ciscocm.v1_java_deserial-CSCwd64245.cop';
else
fix = '12.5(1)SU8 or ciscocm.v1_java_deserial-CSCwd64245.cop';
var vuln_ranges = [
# 12.5(1)SU8 - https://software.cisco.com/download/home/286322286/type/286319236/release/12.5(1)SU8
{'min_ver': '11.5.1', 'fix_ver': '12.5.1.18900.40'},
# 14SU3 - https://software.cisco.com/download/home/286328117/type/286319236/release/14SU3
{'min_ver': '14.0', 'fix_ver': '14.0.1.13900.155'}
];
var reporting = make_array(
'port' , 0,
'severity' , SECURITY_HOLE,
'version' , product_info['display_version'],
'fix' , fix,
'bug_id' , 'CSCwd64245',
'disable_caveat', TRUE
);
cisco::check_and_report(product_info:product_info, reporting:reporting, vuln_ranges:vuln_ranges);
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
53.0%