CVE-2024-20484
📋 TL;DR
An unauthenticated remote attacker can send crafted MR PIM traffic to Cisco Enterprise Chat and Email (ECE) to trigger a denial of service in the External Agent Assignment Service (EAAS). This prevents customers from starting chat, callback, or delayed callback sessions. Affected systems are Cisco ECE deployments with EAAS feature enabled.
💻 Affected Systems
- Cisco Enterprise Chat and Email (ECE)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of chat, callback, and delayed callback services requiring manual EAAS process restart after attack stops.
Likely Case
Intermittent service disruption affecting customer support operations until attack traffic ceases and EAAS is manually restarted.
If Mitigated
Limited impact with proper network segmentation and traffic filtering preventing crafted MR PIM packets from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires sending crafted MR PIM traffic to vulnerable EAAS service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.6(1)ES2 and later
Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-Oqb9uFEv
Restart Required: Yes
Instructions:
1. Download Cisco ECE 12.6(1)ES2 or later from Cisco Software Center. 2. Follow Cisco ECE upgrade documentation. 3. Apply the update to all affected systems. 4. Restart EAAS service after upgrade.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to EAAS service ports to only trusted Cisco Unified CCE systems.
Traffic Filtering
allImplement network filtering to block unexpected MR PIM traffic patterns.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate EAAS service from untrusted networks.
- Deploy intrusion prevention systems to detect and block crafted MR PIM traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check Cisco ECE version via System Console > About. Versions prior to 12.6(1)ES2 are vulnerable if EAAS is enabled.Check Version:
Not provided - use Cisco ECE System Console interfaceVerify Fix Applied:
Verify version is 12.6(1)ES2 or later and test chat/callback functionality.📡 Detection & Monitoring
Log Indicators:
- EAAS service failures
- MR PIM connection errors
- Unusual traffic patterns to EAAS ports
Network Indicators:
- Unexpected MR PIM protocol traffic
- High volume of malformed packets to EAAS service ports
SIEM Query:
source="ece-logs" AND ("EAAS failure" OR "MR PIM error" OR "connection reset")