Cisco releases a patch for critical bugs affecting Unified CCMP and Unified CCDM

Cisco Systems has released security updates for a critical vulnerability affecting Unified Contact Center Management Portal (Unified CCMP) and Unified Contact Center Domain Manager (Unified CCDM), which could allow a remote attacker to take control of an affected system.

Tracked as CVE-2022-20658, the vulnerability has a CVSS severity score of 9.6. It is a privilege-escalation flaw arising from missing server-side validation of user permissions, which could be used to create rogue administrator accounts by submitting a crafted HTTP request.

"With these accounts, an attacker could access and modify a user's telephony resources across all unified platforms associated with the vulnerable Cisco Unified CCMP," Cisco noted in an advisory published this week. "To exploit this vulnerability successfully, an attacker would need valid Advanced User credentials."

Unified CCMP and Unified CCDM versions 12.5.1, 12.0.1, 11.6.1 and earlier, in their default configuration, are affected, the networking company said. It found the issue through Technical Assistance Center (TAC) support. Software version 12.6.1 is not affected.

Although there is no evidence that the security flaw has been exploited in real-world attacks, users are advised to upgrade to the latest version to reduce the associated risk.