---
title: "SECURITY ALERT: Cisco Unified Communications Products Remote Code Execution Vulnerability"
description: Cisco Unified Communications Products Remote Code Execution vulnerability. Find out the affected versions and the necessary course of action to protect your systems. CVE-2024-20253
---

[IT and Cybersecurity News](https://blog.systemsengineering.com/blog)

# [SECURITY ALERT: Cisco Unified Communications Products Remote Code Execution Vulnerability](https://blog.systemsengineering.com/blog/security-alert-cisco-cve-2024-20253)

 Written by [Events at Systems Engineering](https://blog.systemsengineering.com/blog/author/events-at-systems-engineering) | January 27, 2024

Systems Engineering is aware of the Cisco Unified Communications Products Remote Code Execution Vulnerability, [CVE: CVE-2024-20253](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm). 

Cisco rates this vulnerability as CRITICAL. 

### Description

Cisco announced that a vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. A successful attack would allow a malicious attacker to have complete control over the system by obtaining root access. Once they have root access, they can execute malicious commands or attack other aspects of a network. The attacker does not need to compromise credentials to exploit this vulnerability. 

### Scope

This vulnerability is specific to Cisco Unified Communication Phone System servers. Per Cisco's Security Advisory notice, the specific versions that are affected are as follows: 

Unified CM and Unified CM SME: CSCwd64245 

| **Cisco Unified CM and Unified CM SME Release**  | **First Fixed Release**  |
| --- | --- |
| 11.5(1)  | Migrate to a fixed release.  |
| 12.5(1)  | 12.5(1)SU8 or  ciscocm.v1\_java\_deserial-CSCwd64245.cop.sha512  |
| 14  | 14SU3 or  ciscocm.v1\_java\_deserial-CSCwd64245.cop.sha512  |

 

**Unified CM IM&P: CSCwd64276** 

| **Cisco Unified CM IM&P Release**  | **First Fixed Release**  |
| --- | --- |
| 11.5(1)  | Migrate to a fixed release.  |
| 12.5(1)  | 12.5(1)SU8 or  ciscocm.cup-CSCwd64276\_JavaDeserialization.cop.sha512 |
| 14  | 14SU3 or  ciscocm.cup-CSCwd64276\_JavaDeserialization.cop.sha512 |

 

**Unity Connection: CSCwd64292** 

| **Cisco Unity Connection Release**  | **First Fixed Release**  |
| --- | --- |
| 11.5(1)  | Migrate to a fixed release.  |
| 12.5(1)  | 12.5(1)SU8 or  ciscocm.cuc.v1\_java\_deserial-CSCwd64292.k4.cop.sha512  |
| 14  | 14SU3 or  ciscocm.cuc.v1\_java\_deserial-CSCwd64292.k4.cop.sha512  |

 

**UCCX: CSCwe18773** 

| **Cisco UCCX Release**  | **First Fixed Release**  |
| --- | --- |
| 12.0 and earlier  | Migrate to a fixed release.  |
| 12.5(1)  | ucos.v1\_java\_deserial-CSCwd64245.cop.sgn  |

### Course of Action

Cisco has released a patch to remediate affected systems. 

For clients who have Systems Engineering manage their Cisco Unified Communication servers, we will proactively patch your systems and will be in touch about remediating this vulnerability. 

For clients responsible for managing your own Cisco Unified Communication servers, we strongly recommend you patch your affected systems to address this vulnerability. Should you need assistance with the patching process, please contact Systems Engineering Customer Service at 207.772.4199. Our team will open a service ticket to ensure your system is updated against any potential threats.

If you are a Systems Engineering client and have questions about this Security Alert, please contact your Account Manager. 

[View full post](https://blog.systemsengineering.com/blog/security-alert-cisco-cve-2024-20253)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Events at Systems Engineering"
  },
  "dateModified" : "2024-01-27T14:47:24.575Z",
  "datePublished" : "2024-01-27T14:47:10Z",
  "headline" : "SECURITY ALERT: Cisco Unified Communications Products Remote Code Execution Vulnerability",
  "image" : {
    "@type" : "ImageObject",
    "height" : 143,
    "url" : "https://508286.fs1.hubspotusercontent-na1.net/hubfs/508286/286x143-Security%20Alert_Systems%20Engineering.png",
    "width" : 286
  },
  "mainEntityOfPage" : "https://blog.systemsengineering.com/blog/security-alert-cisco-cve-2024-20253",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/508286/Systems%20Engineering%20Logo_2019_Color_100x100px-4.png",
      "width" : 66.92957
    },
    "name" : "<span>Systems Engineering</span> Blog"
  }
}
```