CVE record · CVE-2024-20253

Deserialization of untrusted data in Cisco Unified Contact Center Enterprise and others

CVSS 9.9 CriticalCriticalEPSS 0.024 · 84th percentile

Critical, because:

CVSS score 9.9: 9.0 or more.

Published by the CVE Program (CNA: cisco) at 26 Jan 2024, 17:28 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Cisco	Cisco Unified Contact Center Enterprise	affected N/A
Cisco	Cisco Unity Connection	affected 12.0(1)SU1 affected 12.0(1)SU2 affected 12.0(1)SU3 affected 12.0(1)SU4 affected 12.0(1)SU5 affected 12.5(1) affected 12.5(1)SU1 affected 12.5(1)SU2 affected 12.5(1)SU3 affected 12.5(1)SU4 affected 12.5(1)SU5 affected 12.5(1)SU6 and 4 more
Cisco	Cisco Unified Communications Manager	affected 12.0(1)SU1 affected 12.0(1)SU2 affected 12.0(1)SU3 affected 12.0(1)SU4 affected 12.0(1)SU5 affected 12.5(1) affected 12.5(1)SU1 affected 12.5(1)SU2 affected 12.5(1)SU3 affected 12.5(1)SU4 affected 12.5(1)SU5 affected 12.5(1)SU6 and 5 more
Cisco	Cisco Unified Contact Center Express	affected 8.5(1) affected 9.0(2)SU3ES04 affected 10.0(1)SU1 affected 10.0(1)SU1ES04 affected 10.5(1) affected 10.5(1)SU1 affected 10.5(1)SU1ES10 affected 10.6(1) affected 10.6(1)SU1 affected 10.6(1)SU3 affected 10.6(1)SU2 affected 10.6(1)SU3ES03 and 46 more
Cisco	Cisco Unified Communications Manager IM and Presence Service	affected 10.5(1) affected 10.5(2) affected 10.5(2a) affected 10.5(2b) affected 10.5(2)SU3 affected 10.5(2)SU2a affected 10.5(2)SU4a affected 10.5(2)SU4 affected 10.5(1)SU3 affected 10.5(1)SU1 affected 10.5(2)SU1 affected 10.5(2)SU2 and 32 more
Cisco	Cisco Virtualized Voice Browser	affected 11.0(1) affected 11.5(1) affected 11.5(1)ES29 affected 11.5(1)ES32 affected 11.5(1)_ES43 affected 11.5(1)_ES54 affected 11.5(1)_ES27 affected 11.5(1)ES36 affected 11.5(1)_ES32 affected 11.5(1)_ES29 affected 11.5(1)_ES36 affected 11.5(1)ES43 and 55 more
Cisco	Cisco Packaged Contact Center Enterprise	affected 10.5(1) affected 10.5(2) affected 10.5(1)_ES7 affected 10.5(2)_ES8 affected 11.0(1) affected 11.0(2) affected 11.5(1) affected 11.6(1) affected 11.6(2) affected 12.0(1) affected 12.5(1) affected 12.5(2) and 2 more
Cisco	Cisco Unified Communications Manager / Cisco Unity Connection	affected 10.5(2)SU10 affected 10.5(1) affected 10.5(1)SU1 affected 10.5(1)SU1a affected 10.5(2) affected 10.5(2)SU1 affected 10.5(2)SU2 affected 10.5(2)SU3 affected 10.5(2)SU4 affected 10.5(2)SU5 affected 10.5(2)SU6 affected 10.5(2)SU7 and 33 more

Identifiers: CVE-2024-20253
CNA: cisco
Weakness (CWE): CWE-502
Tags: Cisco Unified Contact Center Enterprise
Cisco Unity Connection
Cisco Unified Communications Manager
Cisco Unified Contact Center Express
Cisco Unified Communications Manager IM and Presence Service
Cisco Virtualized Voice Browser
Cisco Packaged Contact Center Enterprise
Cisco Unified Communications Manager / Cisco Unity Connection
Insecure deserialization
Published: 26 Jan 2024
Updated: 29 May 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
9.9	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H	CNA (cisco)

CISA KEV Not listed.
EPSS 0.024, the 84th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 26 Jan 2024. New records show when each source confirmed them.

Sources

References from the CNA

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-bWNzQcUm

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.