CVE-2024-20252

The attacker prepares a malicious website or crafted link which, when visited by an authenticated user (e.g., an administrator), causes unauthorized HTTP requests to be sent to the affected device. The device, without properly verifying the origin of the request, treats it as legitimate and executes the commands contained within it in the context of the victim's session. In this way, the attacker can perform arbitrary administrative actions without possessing their own credentials.

An attacker can perform arbitrary, unauthorized actions on the device in the context of the logged-in user's privileges — including configuration modification, creation of administrative accounts, or compromise of system confidentiality, integrity, and availability.

Security patches available from the manufacturer should be applied in accordance with references published in the Cisco Security Advisory bulletin (cisco-sa-expressway-csrf-KnnZDMj3). Additionally, it is recommended to restrict access to the administrative interface exclusively to trusted networks and to implement multi-factor authentication mechanisms.

Cisco Expressway Control (Expressway-C), Cisco Expressway Edge (Expressway-E), and Cisco TelePresence Video Communication Server (VCS) — specific versions indicated in the manufacturer's references