CVE-2024-20252: CSRF in Cisco TelePresence VCS Expressway

The CSRF vulnerability allows an attacker to trick a legitimate user into unknowingly performing actions on the Expressway device. This could involve modifying system configurations, adding or removing users, or even initiating video calls. Because the vulnerability is unauthenticated, an attacker does not need valid credentials to exploit it. The potential impact is significant, as a successful attack could grant an attacker complete control over the Expressway device, potentially compromising the entire video conferencing infrastructure. This is particularly concerning in environments where Expressway devices manage critical video conferencing services for sensitive communications.

1. Reserved2023-11-08
2. Published2024-02-07
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-20252 is to upgrade to Cisco TelePresence VCS Expressway version 14.3.3 or later. If immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to sensitive administrative interfaces or implementing stricter authentication controls. Web Application Firewalls (WAFs) configured with appropriate CSRF protection rules can also help mitigate the risk, although this is not a substitute for patching. Monitor Expressway device logs for suspicious activity, particularly unexpected configuration changes or unauthorized user actions. Review and tighten access controls to minimize the potential impact of a successful CSRF attack.