ET WEB_SPECIFIC_APPS Cisco Unified Communications Manager Arbitrary File Write/Remote Code Execution Attempt (CVE-2026-20230)

7.0.3 5.0SID: 2070063Rev: 1Enabled9 views

Fileemerging-web_specific_apps.rules

CreatedJune 25, 2026

UpdatedJune 25, 2026

Classificationattempted-admin

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco Unified Communications Manager Arbitrary File Write/Remote Code Execution Attempt (CVE-2026-20230)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cmplatform/installClusterStatusExecute|3f|"; fast_pattern; startswith; content:"action|3d|clusterNodeInstallStatus"; content:"hostname|3d|"; pcre:"/^[^\x26]*?(?:\x25\x21\x25\x2d\x25\x2d|!--)/R"; reference:url,ssd-disclosure.com/cisco-unified-communications-manager-arbitrary-file-write-to-rce/; reference:cve,2026-20230; classtype:attempted-admin; sid:2070063; rev:1; metadata:affected_product Cisco_Unified_Communications_Manager, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_06_25, cve CVE_2026_20230, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2026_06_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

References

url	ssd-disclosure.com/cisco-unified-communications-manager-arbitrary-file-write-to-rce/
cve	2026-20230

Metadata

affected productCisco_Unified_Communications_Manager

attack targetWeb_Server

tls stateTLSDecrypt

created at2026_06_25

cve

CVE-2026-20230

deploymentSSLDecrypt

performance impactLow

confidenceHigh

signature severityMajor

tagExploit

updated at2026_06_25

mitre tactic idTA0001

mitre tactic nameInitial_Access

mitre technique idT1190

mitre technique nameExploit_Public_Facing_Application

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!