CISCO FIXES UNIFIED COMMUNICATIONS RCE ZERO-DAY EXPLOITED IN ATTACKS

Summary from the TLDR InfoSec newsletter

Cisco has announced a new vulnerability impacting United Communications, Cisco Unity Connection, and Webex Calling Dedicated Instance. The vulnerability is due to improper validation of user-supplied input in HTTP requests that could allow an attacker to obtain access to the underlying system via a sequence of specially crafted HTTP requests. The patches are version-specific, so admins should check the README before applying patches.