Cisco has urged customers to apply its latest security patch to protect their endpoints from a vulnerability tracked as CVE202420272, found in its Unity Connection platform.
This vulnerability allows threat actors to gain root privileges on unpatched endpoints remotely which, in turn, grants them the ability to install malware on the devices.
Unity Connection is a virtualized messaging and voicemail platform that works with email inboxes, web browsers, smartphones, tablets, and other Cisco solutions.
Fixing a dozen flaws
“This vulnerability is due to a lack of authentication in a specific API and improper validation of usersupplied data,” Cisco explained in a security advisory. “An attacker could exploit this vulnerability by uploading arbitrary files to an affected system.”
“A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.”
While the vulnerability sounds dangerous, good news is that no threat actors seem to have discovered it so far. Cisco’s Product Security Incident Response Team (PSIRT) says there is no evidence the flaw was abused in the wild.
The patch for CVE202420727 comes as part of a wider patching effort, BleepingComputer reported. In total, 10 mediumseverity vulnerabilities were addressed, spanning multiple programs. These vulnerabilities could be used to escalate privileges, launch crosssite scripting attacks (XSS), inject commands, and similar.
Lately, Cisco’s been hard at work uncovering and patching zeroday vulnerabilities. In late October last year, the company released a patch to fix two highseverity flaws that were being abused in the wild to take over vulnerable endpoints. One vulnerability was found in the Web User Interface of Cisco IOS XE software connected to the public internet. So, whatever Cisco endpoint (routers, switches, etc.) that runs the software, has HTTP and HTTPS Server features enabled, and is connected to the internet, was vulnerable to full device takeover.