CVE-2024-20272: Cisco Unity Connection · Unrestricted File Upload
Affects Cisco Unity ConnectionSource CVE Database V5
Not known to be exploited · CVSS 7.3 High.
Data as of 26 Oct 2026, 12:54 UTC
- EPSS
- 1.6% chance of exploitation in 30 days – higher than 75% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 17 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Unity Connection | Affected
| Fixed in– |
AI-suggested
In the absence of official patches, European organizations should implement the following specific mitigations: 1) Restrict network access to the Cisco Unity Connection management interface by enforcing strict firewall rules and network segmentation, limiting access only to trusted administrative hosts and networks. 2) Employ Web Application Firewalls (WAFs) or intrusion prevention systems (IPS) with custom rules to detect and block suspicious file upload attempts or anomalous API calls targeting the vulnerable endpoint. 3) Monitor system and application logs for unusual file uploads, command execution attempts, or privilege escalation activities, enabling rapid detection and response. 4) Disable or restrict the vulnerable API if possible through configuration changes or by applying temporary access controls. 5) Conduct thorough inventory and version management to identify all affected Cisco Unity Connection instances and prioritize remediation. 6) Prepare for rapid deployment of official patches once released by Cisco and test updates in controlled environments before production rollout. 7) Educate IT and security teams about this vulnerability to increase awareness and readiness for incident response. 8) Consider deploying endpoint detection and response (EDR) solutions on servers hosting Cisco Unity Connection to detect post-exploitation behaviors.
Description
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by uploading arbitrary files to an affected system. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root.