CVE-2024-20375: Cisco Unified Communications Manager DoS

CVE-2024-20375 Overview

A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper parsing of SIP messages. An attacker could exploit this vulnerability by sending a crafted SIP message to an affected Cisco Unified CM or Cisco Unified CM SME device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition that interrupts the communications of reliant voice and video devices.

Critical Impact
Successful exploitation enables unauthenticated remote attackers to force device reloads, causing significant disruption to enterprise voice and video communications infrastructure.

Affected Products

Cisco Unified Communications Manager 12.0(1)SU1 through 12.0(1)SU5
Cisco Unified Communications Manager 12.5(1) through 12.5(1)SU8a
Cisco Unified Communications Manager Session Management Edition (SME)

Discovery Timeline

August 21, 2024 - CVE-2024-20375 published to NVD
August 1, 2025 - Last updated in NVD database

Technical Details for CVE-2024-20375

Vulnerability Analysis

This vulnerability exists within the SIP (Session Initiation Protocol) call processing function of Cisco Unified Communications Manager. The underlying weakness is classified as CWE-787 (Out-of-bounds Write), indicating that the SIP message parser fails to properly validate input boundaries before writing data to memory. When processing malformed SIP messages, the parser may write data beyond the allocated buffer boundaries, leading to memory corruption that triggers a device reload.

The vulnerability can be exploited remotely over the network without requiring authentication or user interaction. This makes it particularly dangerous in enterprise environments where Unified CM systems are often exposed to handle SIP traffic from various sources including external SIP trunks, remote workers, and third-party integrations.

Root Cause

The root cause of CVE-2024-20375 is improper parsing of SIP messages within the Unified Communications Manager's call processing subsystem. Specifically, the vulnerability stems from an out-of-bounds write condition (CWE-787) where the SIP message parser does not adequately validate the structure and length of incoming SIP message components before processing them. When a specially crafted SIP message containing malformed or oversized fields is received, the parser attempts to write data outside the bounds of allocated memory buffers, corrupting critical memory structures and causing the system to crash and reload.

Attack Vector

The attack vector is network-based, requiring the attacker to send crafted SIP messages to the affected Cisco Unified CM or Unified CM SME device. Since SIP is typically exposed on well-known ports (UDP/TCP 5060 for SIP, 5061 for SIP-TLS), attackers can target these services from anywhere with network connectivity to the device. The attack does not require any authentication credentials, making reconnaissance and exploitation straightforward for attackers who can reach the SIP service.

The exploitation mechanism involves constructing SIP messages with specific malformed elements that trigger the out-of-bounds write condition during parsing. The vulnerability does not enable data exfiltration or privilege escalation but causes immediate service disruption by forcing a device reload, interrupting all active voice and video calls.

Detection Methods for CVE-2024-20375

Indicators of Compromise

Unexpected device reloads or crashes in Cisco Unified CM systems without administrative action
Unusual SIP traffic patterns including malformed or oversized SIP messages targeting UDP/TCP ports 5060 or 5061
Core dump files generated on Unified CM systems indicating memory corruption in SIP processing components
Log entries indicating SIP message parsing failures immediately preceding system restarts

Detection Strategies

Monitor Cisco Unified CM system logs for unexpected restart events and correlate with incoming SIP traffic timestamps
Deploy network-based intrusion detection systems (IDS) with signatures for malformed SIP message patterns
Implement SIP-aware firewalls or session border controllers (SBCs) to inspect and filter malformed SIP traffic before it reaches Unified CM
Configure alerting on Cisco Unified CM for crash events and core dump generation

Monitoring Recommendations

Enable detailed SIP message logging on Cisco Unified CM during investigation periods to capture potentially malicious traffic
Monitor network traffic to SIP ports (5060/5061) for anomalous volume or packet characteristics
Implement centralized log collection from all Unified CM nodes to correlate restart events across the cluster
Set up availability monitoring to detect service interruptions that may indicate active exploitation

How to Mitigate CVE-2024-20375

Immediate Actions Required

Review the Cisco Security Advisory for the latest patch information and apply the appropriate software update
Restrict network access to SIP ports (5060/5061) to only trusted sources using firewall rules or access control lists
Deploy session border controllers (SBCs) in front of Unified CM systems to provide additional SIP message validation and filtering
Ensure redundant Unified CM deployments are in place to maintain service availability if exploitation occurs

Patch Information

Cisco has released security updates to address this vulnerability. Organizations should consult the Cisco Security Advisory for specific fixed software versions applicable to their deployed version. The advisory provides detailed information on which software releases contain the fix for CVE-2024-20375. Affected versions include Unified Communications Manager 12.0(1)SU1 through 12.0(1)SU5 and 12.5(1) through 12.5(1)SU8a.

Workarounds

Implement strict network segmentation to limit exposure of SIP services to only necessary network segments
Configure access control lists (ACLs) on network devices to permit SIP traffic only from known and trusted IP addresses
Deploy an SBC or SIP-aware firewall to normalize and validate all incoming SIP messages before forwarding to Unified CM
Consider disabling unused SIP interfaces or protocols until patches can be applied

bash

# Example: ACL to restrict SIP access to trusted sources only
# Apply on perimeter or internal firewall protecting Unified CM
ip access-list extended PROTECT-CUCM-SIP
 permit udp host 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 5060
 permit tcp host 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 5060
 permit tcp host 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 5061
 deny udp any host 10.2.2.100 eq 5060 log
 deny tcp any host 10.2.2.100 eq 5060 log
 deny tcp any host 10.2.2.100 eq 5061 log
 permit ip any any