CyberCVE

CVE-2024-20414

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affect

Severity
Medium 6.5
CVSS 3.1
Exploited
Not listed
EPSS
0.003
19.6th percentile
Discovered by
Third party
Published by the vendor
Published
Sep 25, 2024
Assigned by cisco

Description

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.

Weakness: CWE-285

Affected products

Vendor Product Category Matched by
Cisco Cisco IOS Software Routing & Switching cna-assigner
Cisco Cisco IOS XE Software Routing & Switching cna-assigner
Vendor-reported affected versions (2)
  • Cisco · IOS
  • Cisco · Cisco IOS XE Software

References