What IT services does KGA provide?

KGA provides comprehensive IT support services including software installation and setup, SaaS system maintenance, application configuration, technical support, digital consulting (including website development), security services, and data management & backup solutions.

What areas do you cover?

Based in Kosai, Shizuoka, we provide remote support nationwide across Japan. On-site support is available primarily in the Tokai region.

Can I consult before signing a contract?

Yes, initial consultation and estimates are completely free. We will listen to your IT challenges and propose the optimal solution.

Is emergency support available?

Yes, the Premium plan includes 24-hour emergency support. The Standard plan also provides priority response during business hours.

Can you set up international TV apps?

Yes, we support the installation and configuration of international TV applications and media players. We help set up environments for legal access to international content.

Do you offer multilingual support?

We support 9 languages: Japanese, English, Portuguese, Korean, Chinese, Malay, Filipino, Vietnamese, and Spanish.

Are there any setup or hidden fees?

No. All prices displayed are final and tax-included. There are no setup fees, hidden charges, or surprise invoices. What you see is exactly what you pay.

Can I change plans later?

Yes. You can upgrade, downgrade, or cancel at any time. Upgrades take effect immediately and we will prorate the difference. Downgrades take effect at the next renewal cycle.

Which payment methods do you accept?

We accept all major credit cards (Visa, Mastercard, JCB, American Express) through Komoju, as well as bank transfers and convenience store payments in Japan. Invoicing is available for Business IT Plan customers.

Do you offer refunds?

Yes. We offer a 14-day money-back guarantee on all annual plans — no questions asked. Monthly Business IT Plan subscriptions can be cancelled at any time with prorated refunds for unused service.

What is the difference between the annual plans and the Business IT Plan?

Annual plans cover app configuration and support for individuals and small teams. The Business IT Plan is a comprehensive monthly subscription for companies that require website development, system management, automation, security, and a dedicated account manager.

Do you provide support in English?

Yes. Our team provides full multilingual support in Japanese, English, Portuguese, Korean, Chinese, Malay, Filipino, Vietnamese, and Spanish — by email, chat, and scheduled video calls.

Cisco Unified CM CVE-2026-20230 exploited

What happened

On June 3, 2026, Cisco fixed CVE-2026-20230, a server-side request forgery (SSRF) flaw in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Unified CM SME, Cisco's enterprise call-control platform. It scores CVSS 8.6, but Cisco rated the impact Critical because it can lead to full (root) control of the server.

A public PoC followed. According to the firm Defused, the first real attacks hit honeypots over the weekend of June 20–22, about 24 hours after the PoC. By June 24 there were automated Tor-routed sweeps dropping webshells. CISA added the flaw to KEV on June 25 with a federal deadline of June 28, and Cisco itself confirmed exploitation.

How the attack works

The attacker, without logging in, sends a crafted HTTP request to WebDialer.
Through the SSRF they stand up a rogue Apache Axis service on the server and gain file write.
They then drop a JSP webshell under /platform-services/axis2-web/ and can run commands, potentially up to root.

Key condition: only systems with WebDialer enabled are vulnerable. It ships disabled by default, but many companies turn it on because it's handy (click a number and your desk phone dials).

What to do

Upgrade to Unified CM 14SU6 or 15SU5 (an interim COP patch exists for 15.x).
If you can't yet, disable WebDialer: Cisco Unified Serviceability > Tools > Service Activation > uncheck Cisco WebDialer Web Service. Cisco says there is no other workaround.
Hunt for compromise: unexpected JSP files under /platform-services/axis2-web/, the test file /tmp/cve-2026-20230-test.txt and suspicious WebDialer requests.
Don't expose your phone system to the internet.

Lesson

"Boring" systems like telephony are exposed too. Patch to mass exploitation took under three weeks, and PoC to first attack took one day.

Sources

Cisco, advisory cisco-sa-cucm-ssrf-cXPnHcW: https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html
Cloud Security Alliance, research note: https://labs.cloudsecurityalliance.org/research/csa-research-note-cisco-unified-cm-ssrf-cve-2026-20230-20260/
Trident Security, "A phone system, one request, and root": https://tridentsecurity.io/blog/cisco-cucm-rce

Does your company run IP telephony or other internet-facing systems? KGA IT offers a free review: kga-it.com.

Cisco Unified CM: WebDialer flaw (CVE-2026-20230) leads to root and is exploited (June 2026)

What happened

How the attack works

What to do

Lesson

Sources

Let's solve your technical challenges together.