Executive Summary
A vulnerability was discovered in CoSoSys Unify which could allow an attacker with administrator access to the Unify Management Console to remotely execute arbitrary code on the server with root privileges.
Netwrix is unaware of any evidence of active exploitation of this vulnerability.
Vulnerability
| Title | Affected Component | Affected Versions | CVSS 4.0 Score | CVSS 3.1 Score (Base / Temporal) | Description |
|---|---|---|---|---|---|
| Remote code execution in Unify Management Console (CVE-2024-44066) | CoSoSys Unify | <= 7.1.0 | 9.4 | 9.1 / 7.9 | A vulnerability in the CoSoSys Unify Management Console could allow an attacker with administrator access to remotely execute arbitrary code on the server with root privileges. |
Exploitability
Factors such as whether details about the vulnerability are publicly known, whether an exploit is readily available, or whether adversaries are actively exploiting the vulnerability are valuable in making risk-based judgements about urgency and priority; customers should use the information below in making those decisions.
| Title | Publicly known? | Exploit available? | Actively exploited? |
|---|---|---|---|
| Remote code execution in Unify Management Console (CVE-2024-44066) | No | No | No |
Solution
CoSoSys Unify customers are advised to take the following actions:
-
Download the relevant security hotfix for your Unify installation:
Product Applicable Version Downloads CoSoSys Unify 7.0.6.2 Download offline patch CoSoSys Unify 7.1.2 Download offline patch -
Apply the security hotfix via the Offline Patch feature.
Official Fixes
Updated software has been released containing official fixes as indicated in the table below.
| Product | Current Version | Hotfix Version |
|---|---|---|
| CoSoSys Unify | 7.0.6.2 | 7.0.6.2 Hotfix #1.2 |
| CoSoSys Unify | 7.1.0 | 7.1.0 Hotfix #1.2 |
FAQ
-
How do I determine the version of CoSoSys Endpoint Protector and whether the patch is applied?
Please refer to this knowledge base article.
Revisions
Updates to this advisory may be made as necessary. Information about each change will be published in the table below.
| Revision | Date | Description |
|---|---|---|
| 1 | 2024-09-17T12:00:00Z | First published |
Disclaimer
The information and materials included in or linked to this Security Advisory are provided on an “as-is” basis and without warranty of any kind, and we disclaim all representations and warranties of any kind, whether express or implied, including warranties of merchantability and fitness for a particular use. You acknowledge and agree that your use of the information and materials included in or linked to this Security Advisory are at your own risk.