CVE-2024-20414

State: Published
Severity: 6.5 Medium
Published: Sep 25, 2024
Updated: Sep 25, 2024
Reserved: Nov 8, 2023

Description

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	cisco

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
IOSCisco	15.2(6)E2Affected 15.2(7)EAffected 15.2(6)E2aAffected 15.2(6)E2bAffected 15.2(7)E1Affected 15.2(7)E0aAffected 15.2(7)E0bAffected 15.2(7)E0sAffected 15.2(6)E3Affected 15.2(7)E2Affected 15.2(7a)E0bAffected 15.2(7)E3Affected 15.2(7)E1aAffected 15.2(7b)E0bAffected 15.2(7)E2aAffected 15.2(7)E4Affected 15.2(7)E3kAffected 15.2(8)EAffected 15.2(8)E1Affected 15.2(7)E5Affected 15.2(7)E6Affected 15.2(8)E2Affected 15.2(7)E7Affected 15.2(8)E3Affected 15.2(7)E8Affected and 5 more versions
Cisco IOS XE SoftwareCisco	3.2.0SGAffected 3.2.1SGAffected 3.2.2SGAffected 3.2.3SGAffected 3.2.4SGAffected 3.2.5SGAffected 3.2.6SGAffected 3.2.7SGAffected 3.2.8SGAffected 3.2.9SGAffected 3.2.10SGAffected 3.2.11SGAffected 3.7.0SAffected 3.7.1SAffected 3.7.2SAffected 3.7.3SAffected 3.7.4SAffected 3.7.5SAffected 3.7.6SAffected 3.7.7SAffected 3.7.4aSAffected 3.7.2tSAffected 3.7.0bSAffected 3.7.1aSAffected 3.3.0SGAffected and 406 more versions

Product

Versions

IOSCisco

15.2(6)E2Affected
15.2(7)EAffected
15.2(6)E2aAffected
15.2(6)E2bAffected
15.2(7)E1Affected
15.2(7)E0aAffected
15.2(7)E0bAffected
15.2(7)E0sAffected
15.2(6)E3Affected
15.2(7)E2Affected
15.2(7a)E0bAffected
15.2(7)E3Affected
15.2(7)E1aAffected
15.2(7b)E0bAffected
15.2(7)E2aAffected
15.2(7)E4Affected
15.2(7)E3kAffected
15.2(8)EAffected
15.2(8)E1Affected
15.2(7)E5Affected
15.2(7)E6Affected
15.2(8)E2Affected
15.2(7)E7Affected
15.2(8)E3Affected
15.2(7)E8Affected
and 5 more versions

Cisco IOS XE SoftwareCisco

3.2.0SGAffected
3.2.1SGAffected
3.2.2SGAffected
3.2.3SGAffected
3.2.4SGAffected
3.2.5SGAffected
3.2.6SGAffected
3.2.7SGAffected
3.2.8SGAffected
3.2.9SGAffected
3.2.10SGAffected
3.2.11SGAffected
3.7.0SAffected
3.7.1SAffected
3.7.2SAffected
3.7.3SAffected
3.7.4SAffected
3.7.5SAffected
3.7.6SAffected
3.7.7SAffected
3.7.4aSAffected
3.7.2tSAffected
3.7.0bSAffected
3.7.1aSAffected
3.3.0SGAffected
and 406 more versions

References

cisco-sa-ios-webui-HfwnRgk

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.