CVE-2024-20254

An attacker, exploiting the CSRF vulnerability, can trick a logged-in user (e.g., an administrator) into visiting a crafted website or clicking on a malicious link. The victim's browser then sends an unauthorized HTTP request to the vulnerable device, which treats it as legitimate because it originates from an authenticated session. As a result, the attacker can instruct the execution of arbitrary operations on behalf of the victim without their knowledge or consent. The vulnerability affects both Cisco Expressway Control (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices.

An attacker can perform arbitrary, unauthorized actions on the vulnerable device with the privileges of the attacked user, which may lead to complete device takeover, violation of data confidentiality and integrity, and disruption of its availability.

Apply patches available from the manufacturer in accordance with references published at: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3. Additionally, it is recommended to restrict access to device management interfaces exclusively to trusted networks and to implement administrative session protection mechanisms.

Cisco Expressway Control (Expressway-C), Cisco Expressway Edge (Expressway-E), and Cisco TelePresence Video Communication Server (VCS) — versions indicated in the manufacturer's references.