CVE-2024-20272

CVE-2024-20272 is a critical vulnerability in the web-based management interface of Cisco Unity Connection. This flaw allows an unauthenticated, remote attacker to upload arbitrary files and execute commands on the underlying operating system due to a lack of authentication in a specific API and improper data validation. With a CVSS score of 9.8 (CRITICAL), a successful exploit could lead to arbitrary command execution and root privilege escalation. While there is no known active exploitation (KEV: No), the vulnerability has garnered significant community attention with 3 mentions and 2 media articles, indicating a high potential for future exploitation. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB: None).