Security Issues

■ Reviewing Vulnerability Scan Findings: Vulnerability scans may report outdated .NET or Erlang versions on a UMP-365 VM. In many cases, the affected services are not accessible from outside the environment, reducing their exposure. Nevertheless, security patches should be applied. This section helps identify which findings require action and which are mitigated by the deployment architecture.
■ Why scanners report these findings: Tools such as Nessus, Qualys and Microsoft Defender for Cloud run a credentialed scan: they sign in to the VM, read which software versions are installed, and compare them with lists of known vulnerabilities (CVEs). They do not test whether the vulnerable code can be reached over the network, or whether UMP-365 uses it at all. Therefore, the report lists every CVE for every installed version of the .NET runtime, the ASP.NET Core hosting bundle, Erlang/OTP, RabbitMQ and SQL Server, including old .NET runtimes that are still installed, however no longer used.
■ What the WAF architecture changes: The only traffic from outside is HTTPS to the WAF. The WAF terminates the user's TLS and HTTPS connection, inspects the request against its rules, and then opens a new HTTP/1.1 connection to IIS on port 80:
● Back-end ports are not reachable: SQL Server, RabbitMQ, the Erlang port mapper and the RabbitMQ management page are blocked by the NSG. Any vulnerability inherent in these components cannot be exploited from the public internet.
● Connection-level attacks stop at the WAF: Vulnerabilities regarding how the VM handles TLS, HTTP/2 or malformed connections, for example HTTP/2 Rapid Reset (CVE-2023-44487), require a direct connection to the VM; which only the WAF possesses over plain HTTP/1.1 to IIS.
● Request content still reaches UMPThe body, query string and headers of a request that traverse the WAF rules arrive at the application unchanged. A vulnerability triggered by content in an ordinary-looking request is still exploitable, whether it comes from the WAF or not.
■ Commonly asked questions:
● Is the component used by UMP? UMP-365 runs on .NET 8. On the VM, dotnet --list-runtimes shows what is installed. A finding on another run time, such as .NET 6 or an older 8.0 patch left installed beside the current one, is closed by uninstalling it.
● Can the vulnerable component be reached from outside the VM ? Check the port with the NSG table in Firewall Rules. A blocked port or a component that only listens on localhost implies that it's not exploitable from the network.
● Does the attack require a direct connection to the VM ? If it attacks TLS or the HTTP protocol itself, the WAF stops it.
● Is it triggered by request content? If so, patch it, even behind the WAF.

Common findings on a UMP VM

Finding Exploitable in this design? What to do

Erlang/OTP SSH server remote code execution (CVE-2025-32433)

No. RabbitMQ does not start the Erlang SSH server, and the Erlang ports are blockedץ

Record as not exploitable. Fixed by the next Erlang upgrade

Other Erlang/OTP and RabbitMQ CVEs

Not from outside: ports 5672, 15672, 4369 and 25672 are blocked, and RabbitMQ only lets the guest user connect from localhost

Upgrade at the next maintenance window. RabbitMQ only supports specific Erlang versions, so check the RabbitMQ compatibility table, and ask AudioCodes before a major version upgrade

.NET or ASP.NET Core CVEs in TLS, HTTP/2 or connection handling

No, the WAF holds the client connection

Install the latest .NET 8 patch at the next maintenance window

.NET or ASP.NET Core CVEs triggered by request content

Yes

Install the latest .NET 8 patch (8.0.x, including the ASP.NET Core hosting bundle) soon, then run iisreset. Microsoft designs patches within 8.0 to be compatible, however, tests them on a non-production system first.

Old .NET runtimes installed but not used

No, nothing runs on them

Uninstall them

.NET 8 end of support

Yes, and a WAF cannot fix it

.NET 8 support ends Nov 10, 2026. After that date Microsoft publishes no more security fixes for it. Plan the upgrade to a UMP-365 release on a supported .NET version with AudioCodes.

SQL Server CVEs

Not from outside: port blocked

Install the latest SQL Server cumulative update.

Self-signed certificate, or TLS 1.0 or 1.1, on the VM

Only from inside the network

Remove the *:443 binding (Step 2) and disable old TLS versions on Windows.

API description (Swagger) publicly readable

No, once the WAF rule described in Step 1- Configure WAF is configured.

Keep the rule.
■ What the WAF does not protect against:
● Attacks from inside the network: Another compromised VM in the same virtual network, or a compromised admin PC on the VPN, reaches all these ports directly.
● Default credentials: Change the SQL Server sa password that the prerequisite script sets, and do not let the RabbitMQ guest user be used from outside localhost.
● Software out of support: An unsupported version requires no fixes for future vulnerabilities. Keep a patch cycle for Windows, .NET, SQL Server, Erlang and RabbitMQ in any case.