Cisco Expressway Series और Cisco TelePresence Video Communication Server (VCS) में कई कमजोरियाँ एक गैर-प्रमाणित, दूरस्थ हमलावर को क्रॉस-साइट रिक्वेस्ट फोर्जरी (CSRF) करने की अनुमति दे सकती हैं।

The CSRF vulnerability allows an attacker to trick a legitimate user into unknowingly performing actions on the Expressway device. For example, an attacker could craft a malicious link that, when clicked by an authenticated user, modifies system settings, adds or removes users, or initiates unauthorized video conferences. The impact is particularly severe because the vulnerability is unauthenticated, meaning an attacker doesn't need valid credentials to exploit it. Successful exploitation could lead to complete compromise of the Expressway device and potentially provide a foothold into the broader network it serves, enabling lateral movement and data exfiltration. This vulnerability shares similarities with other CSRF attacks, where user interaction is leveraged to execute malicious commands.

Organizations heavily reliant on Cisco TelePresence for video conferencing and collaboration are at significant risk. Specifically, deployments with older Expressway versions (X8.1–X14.3.2) and those lacking robust network segmentation or WAF protection are particularly vulnerable. Shared hosting environments utilizing Cisco Expressway may also be at increased risk due to potential cross-tenant vulnerabilities.

• linux / server:

journalctl -u expressway | grep -i "csrf"

• cisco:

show running-config | grep -i "csrf"

• generic web:

curl -I <expressway_url> | grep -i "x-frame-options"

• generic web: Check response headers for missing or weak X-Frame-Options and Content-Security-Policy headers.

1. 2024-02-07Disclosure

   disclosure

1. आरक्षित2023-11-08
2. प्रकाशित2024-02-07
3. संशोधित2024-08-22
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-20254 is to upgrade to Cisco Expressway version 14.3.3 or later. If immediate upgrading is not possible, consider implementing temporary workarounds. These may include restricting access to the Expressway management interface to trusted networks, implementing strict input validation on all user-supplied data, and utilizing a Web Application Firewall (WAF) to filter out malicious requests. Configure the WAF to block requests containing suspicious parameters or patterns commonly associated with CSRF attacks. Regularly review Expressway device logs for any unusual activity or unauthorized modifications.