Cisco has identified and patched several critical vulnerabilities in its Expressway Series collaboration gateways, which could expose vulnerable devices to cross-site request forgery (CSRF) attacks. The Cisco Expressway Series is a set of collaboration gateways designed to provide secure and efficient communication and collaboration for organizations. These vulnerabilities pose a significant risk of unauthorized access, privilege escalation, and denial-of-service (DoS) conditions.
Details of Vulnerabilities
- CVE-2024-20252 and CVE-2024-20254 (CVSS score: 9.6):
- These vulnerabilities impact Cisco Expressway Series devices and can be exploited remotely by unauthenticated attackers.
- Insufficient CSRF protections in the web-based management interface may allow attackers to conduct CSRF attacks.
- Successful exploitation could enable attackers to perform arbitrary actions with the privilege level of the affected user, including modifying system configurations and creating new privileged accounts.
- Affected devices in the default configuration are vulnerable, while CVE-2024-20252 requires the cluster database (CDB) API feature to be enabled.
- CVE-2024-20255 (CVSS score: 8.2):
- This vulnerability affects Cisco Expressway Series devices, allowing unauthenticated, remote attackers to conduct CSRF attacks.
- Exploitation may lead to the overwriting of system configuration settings, resulting in a denial-of-service (DoS) condition.
- The impact is higher if the affected user has administrative privileges.
Affected Products
- CVE-2024-20254 and CVE-2024-20255: Cisco Expressway Series devices in the default configuration.
- CVE-2024-20252: Cisco Expressway Series devices with the cluster database (CDB) API feature enabled.
Mitigation and Patching
- No workarounds are available to address these vulnerabilities.
- Cisco has released software updates addressing these vulnerabilities in Cisco Expressway Series Release versions 14.3.4 and 15.0.0.
- Users are advised to upgrade to the fixed software releases based on their current version.
- To enable the complete fix, users should run the xconfiguration Security CSRFProtection status: "Enabled" command, as detailed in the Cisco Expressway Administrator Guide.
Exploitation and Public Announcements
- The Cisco PSIRT is not aware of any public announcements or malicious use of these vulnerabilities.
- Users are urged to apply the provided patches promptly to mitigate the risk of exploitation.
References