CVE-2024-20347

published 2024-04-03

CVE-2024-20347: A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow the attacker to…

Priority P3 37 medium 6.5 CVSS 3.1

AV N AC L PR N UI R S U C N I H A N

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user, such as deleting users from the device.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_emergency_responder	—	—
cisco	emergency_responder	< 12.5(1)su8b	12.5(1)su8b
cisco	emergency_responder	—	—
cisco	emergency_responder	—	—
cisco	emergency_responder	—	—
cisco	emergency_responder	—	—
cisco	emergency_responder	—	—
cisco	emergency_responder	—	—

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vendor_cisco 4.9 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352 CWE-23