dbcve.org
ExpresswayApplication · Cisco

CVE-2024-20255

HIGH · 7.1 CVSS v3.1 Published 2024-02-07
Fix available
A fix is available. Upgrade to 15.0 or later.
See remediation →
78/100
Remediation priority · High
Remotely reachable No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is a CSRF (Cross-Site Request Forgery) vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server. The web-based management interface lacks sufficient CSRF protection mechanisms. An unauthenticated remote attacker can exploit this by tricking a user into following a crafted link, causing the system to reload (Denial of Service).

MitigationImplement anti-CSRF tokens for all SOAP API endpoints and ensure proper token validation on state-changing requests. Users should avoid clicking untrusted links while authenticated to the management interface until the patch is applied.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
ExpresswayApplication
Affected:< 15.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the installed product and version
    Access the web management interface or CLI and retrieve the system version. For web interface, check the 'System' > 'Product' page. For CLI, use 'version' command.
    Affected if The product is Cisco Expressway Series or Cisco TelePresence VCS and the version is below 15.0 (e.g., 14.x, earlier releases)
  2. Confirm SOAP API is accessible
    Attempt to access the SOAP API endpoint. Typical path is /soap endpoint on the management interface. Check if the service responds to SOAP requests.
    Affected if SOAP API endpoints are reachable without authentication or with valid session credentials
  3. Verify web-based management interface is enabled
    Check if the HTTP/HTTPS management interface is active. Use 'webadmin' or 'HTTP' show commands via CLI, or attempt to reach the web login page over the network.
    Affected if The web management interface is enabled and accessible to users or attackers on the network
  4. Check for CSRF protection mechanisms
    Inspect HTTP responses from the SOAP API and management interface for anti-CSRF tokens or headers. Submit a state-changing SOAP request and observe if a token is required or validated.
    Affected if SOAP API requests do not require or validate anti-CSRF tokens, or no token is present in requests
  5. Determine network exposure of management interface
    Review firewall rules, access lists, or interface bindings to determine if the management interface is exposed to untrusted networks or the internet.
    Affected if The management interface is reachable from untrusted networks, increasing the likelihood of a CSRF attack

You are affected if you run Cisco Expressway or Cisco TelePresence VCS version below 15.0, have the SOAP API and web management interface enabled, and lack CSRF token protection in SOAP requests.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 15.0 or later
Fixed in 15.0
Interim mitigation

Implement anti-CSRF tokens for all SOAP API endpoints and ensure proper token validation on state-changing requests. Users should avoid clicking untrusted links while authenticated to the management interface until the patch is applied.

Recommended fix High confidence

Cisco Expressway version 15.0 or later

  1. 1. Back up the current Cisco Expressway configuration using the web interface or CLI backup commands
  2. 2. Download the Cisco Expressway version 15.0 or later from the Cisco Software Download center
  3. 3. Access the Cisco Expressway web-based management interface
  4. 4. Navigate to Maintenance > Software Upgrade
  5. 5. Upload the new software image file
  6. 6. Follow the on-screen prompts to upgrade the system
  7. 7. After upgrade completes, verify the system is operational and restore configuration if needed
  8. 8. Confirm the version shows 15.0 or later via the web interface or CLI: xstatus version

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Expressway Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-20255 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-20255 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data