# MA-1089.072024: MyCERT Advisory - Cisco High Severity Security Advisory: Remote Unauthenticated Code

**Date:** 04 Jul 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1089.072024  
**Advisory ID:** MA-1089.072024

---

**1.0 Introduction**
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.
**2.0 Impact**
A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish *root* access on the affected device.
**3.0 Affected Products**
- Unified Communications Manager (Unified CM) ([CSCwd64245](https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd64245))
- Unified Communications Manager IM & Presence Service (Unified CM IM&P) ([CSCwd64276](https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd64276))
- Unified Communications Manager Session Management Edition (Unified CM SME) ([CSCwd64245](https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd64245))
- Unified Contact Center Express (UCCX) ([CSCwe18773](https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe18773))
- Unity Connection ([CSCwd64292](https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd64292))
- Virtualized Voice Browser (VVB) ([CSCwe18840](https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe18840))
**4.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review the following [Cisco Security Updates](https://sec.cloudapps.cisco.com/security/center/publicationListing.x) and apply the necessary updates:
- Cisco Unified Communications Products Remote Code Execution Vulnerability <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm>
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact the Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0    References**
- <https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm>