ET WEB_SPECIFIC_APPS Cisco Unified Communications Manager Arbitrary File Write/Remote Code Execution Attempt (CVE-2026-20230)

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Cisco Unified Communications Manager Arbitrary File Write/Remote Code Execution Attempt (CVE-2026-20230)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/cmplatform/installClusterStatusExecute|3f|"; fast_pattern; startswith;
    content:"action|3d|clusterNodeInstallStatus";
    content:"hostname|3d|";
    pcre:"/^[^\x26]*?(?:\x25\x21\x25\x2d\x25\x2d|!--)/R";
    reference:url,ssd-disclosure.com/cisco-unified-communications-manager-arbitrary-file-write-to-rce/;
    reference:cve,2026-20230;
    classtype:attempted-admin;
    sid:2070063; rev:1;
    metadata:affected_product Cisco_Unified_Communications_Manager, attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_06_25, cve CVE_2026_20230, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2026_06_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)