Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF)

The CSRF vulnerability allows an attacker to trick a legitimate user into unknowingly performing actions on the Expressway device. This could involve modifying system configurations, adding or removing users, or even initiating video calls. Because the vulnerability is unauthenticated, an attacker does not need valid credentials to exploit it. The potential impact is significant, as a successful attack could grant an attacker complete control over the Expressway device, potentially compromising the entire video conferencing infrastructure. This is particularly concerning in environments where Expressway devices manage critical video conferencing services for sensitive communications.

Organizations heavily reliant on Cisco TelePresence VCS Expressway for video conferencing, particularly those with legacy configurations or shared hosting environments, are at significant risk. Environments with limited security controls or infrequent patching cycles are also particularly vulnerable. Companies using Expressway devices to manage video conferencing for sensitive data or communications should prioritize remediation.

• cisco: Use Cisco's security advisory to identify affected devices. • linux / server: Monitor Expressway device logs (typically located in /var/log/expressway/) for unusual HTTP requests or POST requests to administrative interfaces. Use grep to search for patterns indicative of CSRF attacks, such as requests originating from unexpected sources or containing suspicious parameters. • generic web: Use curl to test for CSRF vulnerabilities on sensitive administrative endpoints. Attempt to trigger actions without proper authentication to see if the device responds as if the request originated from an authenticated user.

curl -v -X POST -d 'param1=value1&param2=value2' https://expressway.example.com/admin/sensitive_action

1. 2024-02-07Disclosure

   disclosure

2. 2024-02-07Patch

   patch

3. 2024-02-07CISA KEV

   kev

1. आरक्षित2023-11-08
2. प्रकाशित2024-02-07
3. संशोधित2024-08-01
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-20252 is to upgrade to Cisco TelePresence VCS Expressway version 14.3.3 or later. If immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to sensitive administrative interfaces or implementing stricter authentication controls. Web Application Firewalls (WAFs) configured with appropriate CSRF protection rules can also help mitigate the risk, although this is not a substitute for patching. Monitor Expressway device logs for suspicious activity, particularly unexpected configuration changes or unauthorized user actions. Review and tighten access controls to minimize the potential impact of a successful CSRF attack.