CVE-2024-20255

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) due to insufficient CSRF protections for the web-based management interface. This affects all versions prior to the fixed releases mentioned in the advisory. The vulnerability is exploitable without authentication [1].

Exploitation

An attacker can exploit this vulnerability by persuading a user with authenticated access to the REST API to follow a crafted link. The attacker must be remote and unauthenticated, but requires the victim user to interact with the malicious link. No special network position is needed beyond reachability of the affected device [1].

Impact

A successful exploit allows the attacker to cause the affected system to reload, resulting in a denial of service (DoS) condition. The attack does not lead to data disclosure, privilege escalation, or remote code execution; the impact is limited to availability [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Users with service contracts should obtain fixes through their usual update channels. Customers without service contracts should contact Cisco TAC. No workarounds are documented. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].