CVE-2020-3280
published 2020-05-22CVE-2020-3280: A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.94%
93.4th percentile
A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user on an affected device.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | unified_contact_center_express | — | — |
| cisco | unified_contact_center_express | >= 12.0 < 12.0\(1\)es03 | 12.0\(1\)es03 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit vector targets the Java Remote Management Interface (Java RMI) listener on Cisco Unified CCX; monitor for malicious serialized Java objects sent to the RMI listener port ↗
- →Exploitation results in code execution as root; alert on unexpected root-level process spawning from the Unified CCX Java RMI service ↗
- →The attack is unauthenticated and remote; no prior credentials required — prioritize network-level detection/blocking of inbound connections to the RMI listener from untrusted sources ↗
- ·No workarounds are available for this vulnerability; patching is the only remediation path ↗
- ·Vulnerability is due to insecure deserialization of user-supplied content; Java deserialization filtering/controls on the RMI interface should be reviewed as a defense-in-depth measure ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
vendor_cisco·2020-05-20·CVSS 9.8
CVE-2020-3280 [CRITICAL] CWE-20 Cisco Unified Contact Center Express Remote Code Execution Vulnerability
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.
The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user on an affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the foll
Cisco
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3280 Cisco Unified Contact Center Express Remote Code Execution Vulnerability
CVE-2020-3280: Cisco Unified Contact Center Express Remote Code Execution Vulnerability
A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user on an affected device. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-20, CWE-20
Bug IDs: CSCvq58235, CSCvq58289
GHSA
GHSA-7qv8-fcr4-9523: A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote a
ghsa_unreviewed·2022-05-24
CVE-2020-3280 [HIGH] GHSA-7qv8-fcr4-9523: A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote a
A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user on an affected device.
No detection rules found.
No public exploits indexed.
2020-05-22
Published