CVE-2024-20375 Overview
A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper parsing of SIP messages. An attacker could exploit this vulnerability by sending a crafted SIP message to an affected Cisco Unified CM or Cisco Unified CM SME device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition that interrupts the communications of reliant voice and video devices.
Critical Impact
Successful exploitation enables unauthenticated remote attackers to force device reloads, causing significant disruption to enterprise voice and video communications infrastructure.
Affected Products
- Cisco Unified Communications Manager 12.0(1)SU1 through 12.0(1)SU5
- Cisco Unified Communications Manager 12.5(1) through 12.5(1)SU8a
- Cisco Unified Communications Manager Session Management Edition (SME)
Discovery Timeline
- August 21, 2024 - CVE-2024-20375 published to NVD
- August 1, 2025 - Last updated in NVD database
Technical Details for CVE-2024-20375
Vulnerability Analysis
This vulnerability exists within the SIP (Session Initiation Protocol) call processing function of Cisco Unified Communications Manager. The underlying weakness is classified as CWE-787 (Out-of-bounds Write), indicating that the SIP message parser fails to properly validate input boundaries before writing data to memory. When processing malformed SIP messages, the parser may write data beyond the allocated buffer boundaries, leading to memory corruption that triggers a device reload.
The vulnerability can be exploited remotely over the network without requiring authentication or user interaction. This makes it particularly dangerous in enterprise environments where Unified CM systems are often exposed to handle SIP traffic from various sources including external SIP trunks, remote workers, and third-party integrations.
Root Cause
The root cause of CVE-2024-20375 is improper parsing of SIP messages within the Unified Communications Manager's call processing subsystem. Specifically, the vulnerability stems from an out-of-bounds write condition (CWE-787) where the SIP message parser does not adequately validate the structure and length of incoming SIP message components before processing them. When a specially crafted SIP message containing malformed or oversized fields is received, the parser attempts to write data outside the bounds of allocated memory buffers, corrupting critical memory structures and causing the system to crash and reload.
Attack Vector
The attack vector is network-based, requiring the attacker to send crafted SIP messages to the affected Cisco Unified CM or Unified CM SME device. Since SIP is typically exposed on well-known ports (UDP/TCP 5060 for SIP, 5061 for SIP-TLS), attackers can target these services from anywhere with network connectivity to the device. The attack does not require any authentication credentials, making reconnaissance and exploitation straightforward for attackers who can reach the SIP service.
The exploitation mechanism involves constructing SIP messages with specific malformed elements that trigger the out-of-bounds write condition during parsing. The vulnerability does not enable data exfiltration or privilege escalation but causes immediate service disruption by forcing a device reload, interrupting all active voice and video calls.
Detection Methods for CVE-2024-20375
Indicators of Compromise
- Unexpected device reloads or crashes in Cisco Unified CM systems without administrative action
- Unusual SIP traffic patterns including malformed or oversized SIP messages targeting UDP/TCP ports 5060 or 5061
- Core dump files generated on Unified CM systems indicating memory corruption in SIP processing components
- Log entries indicating SIP message parsing failures immediately preceding system restarts
Detection Strategies
- Monitor Cisco Unified CM system logs for unexpected restart events and correlate with incoming SIP traffic timestamps
- Deploy network-based intrusion detection systems (IDS) with signatures for malformed SIP message patterns
- Implement SIP-aware firewalls or session border controllers (SBCs) to inspect and filter malformed SIP traffic before it reaches Unified CM
- Configure alerting on Cisco Unified CM for crash events and core dump generation
Monitoring Recommendations
- Enable detailed SIP message logging on Cisco Unified CM during investigation periods to capture potentially malicious traffic
- Monitor network traffic to SIP ports (5060/5061) for anomalous volume or packet characteristics
- Implement centralized log collection from all Unified CM nodes to correlate restart events across the cluster
- Set up availability monitoring to detect service interruptions that may indicate active exploitation
How to Mitigate CVE-2024-20375
Immediate Actions Required
- Review the Cisco Security Advisory for the latest patch information and apply the appropriate software update
- Restrict network access to SIP ports (5060/5061) to only trusted sources using firewall rules or access control lists
- Deploy session border controllers (SBCs) in front of Unified CM systems to provide additional SIP message validation and filtering
- Ensure redundant Unified CM deployments are in place to maintain service availability if exploitation occurs
Patch Information
Cisco has released security updates to address this vulnerability. Organizations should consult the Cisco Security Advisory for specific fixed software versions applicable to their deployed version. The advisory provides detailed information on which software releases contain the fix for CVE-2024-20375. Affected versions include Unified Communications Manager 12.0(1)SU1 through 12.0(1)SU5 and 12.5(1) through 12.5(1)SU8a.
Workarounds
- Implement strict network segmentation to limit exposure of SIP services to only necessary network segments
- Configure access control lists (ACLs) on network devices to permit SIP traffic only from known and trusted IP addresses
- Deploy an SBC or SIP-aware firewall to normalize and validate all incoming SIP messages before forwarding to Unified CM
- Consider disabling unused SIP interfaces or protocols until patches can be applied
# Example: ACL to restrict SIP access to trusted sources only
# Apply on perimeter or internal firewall protecting Unified CM
ip access-list extended PROTECT-CUCM-SIP
permit udp host 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 5060
permit tcp host 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 5060
permit tcp host 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 5061
deny udp any host 10.2.2.100 eq 5060 log
deny tcp any host 10.2.2.100 eq 5060 log
deny tcp any host 10.2.2.100 eq 5061 log
permit ip any any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
