First published: Wed Sep 25 2024(Updated: )
A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.
Credit: ykramarz@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco IOS XE | =3.2.0se | |
Cisco IOS XE | =3.2.0sg | |
Cisco IOS XE | =3.2.1se | |
Cisco IOS XE | =3.2.1sg | |
Cisco IOS XE | =3.2.2se | |
Cisco IOS XE | =3.2.2sg | |
Cisco IOS XE | =3.2.3se | |
Cisco IOS XE | =3.2.3sg | |
Cisco IOS XE | =3.2.4sg | |
Cisco IOS XE | =3.2.5sg | |
Cisco IOS XE | =3.2.6sg | |
Cisco IOS XE | =3.2.7sg | |
Cisco IOS XE | =3.2.8sg | |
Cisco IOS XE | =3.2.9sg | |
Cisco IOS XE | =3.2.10sg | |
Cisco IOS XE | =3.2.11sg | |
Cisco IOS XE | =3.3.0se | |
Cisco IOS XE | =3.3.0sg | |
Cisco IOS XE | =3.3.0sq | |
Cisco IOS XE | =3.3.1se | |
Cisco IOS XE | =3.3.1sg | |
Cisco IOS XE | =3.3.1sq | |
Cisco IOS XE | =3.3.2se | |
Cisco IOS XE | =3.3.2sg | |
Cisco IOS XE | =3.3.3se | |
Cisco IOS XE | =3.3.4se | |
Cisco IOS XE | =3.3.5se | |
Cisco IOS XE | =3.4.0sg | |
Cisco IOS XE | =3.4.0sq | |
Cisco IOS XE | =3.4.1sg | |
Cisco IOS XE | =3.4.1sq | |
Cisco IOS XE | =3.4.2sg | |
Cisco IOS XE | =3.4.3sg | |
Cisco IOS XE | =3.4.4sg | |
Cisco IOS XE | =3.4.5sg | |
Cisco IOS XE | =3.4.6sg | |
Cisco IOS XE | =3.4.7sg | |
Cisco IOS XE | =3.4.8sg | |
Cisco IOS XE | =3.5.0e | |
Cisco IOS XE | =3.5.0sq | |
Cisco IOS XE | =3.5.1e | |
Cisco IOS XE | =3.5.1sq | |
Cisco IOS XE | =3.5.2e | |
Cisco IOS XE | =3.5.2sq | |
Cisco IOS XE | =3.5.3e | |
Cisco IOS XE | =3.5.3sq | |
Cisco IOS XE | =3.5.4sq | |
Cisco IOS XE | =3.5.5sq | |
Cisco IOS XE | =3.5.6sq | |
Cisco IOS XE | =3.5.7sq | |
Cisco IOS XE | =3.5.8sq | |
Cisco IOS XE | =3.6.0e | |
Cisco IOS XE | =3.6.1e | |
Cisco IOS XE | =3.6.2ae | |
Cisco IOS XE | =3.6.2e | |
Cisco IOS XE | =3.6.3e | |
Cisco IOS XE | =3.6.4e | |
Cisco IOS XE | =3.6.5ae | |
Cisco IOS XE | =3.6.5be | |
Cisco IOS XE | =3.6.5e | |
Cisco IOS XE | =3.6.6e | |
Cisco IOS XE | =3.6.7be | |
Cisco IOS XE | =3.6.7e | |
Cisco IOS XE | =3.6.8e | |
Cisco IOS XE | =3.6.9e | |
Cisco IOS XE | =3.6.10e | |
Cisco IOS XE | =3.7.0bs | |
Cisco IOS XE | =3.7.0e | |
Cisco IOS XE | =3.7.0s | |
Cisco IOS XE | =3.7.1as | |
Cisco IOS XE | =3.7.1e | |
Cisco IOS XE | =3.7.1s | |
Cisco IOS XE | =3.7.2e | |
Cisco IOS XE | =3.7.2s | |
Cisco IOS XE | =3.7.2ts | |
Cisco IOS XE | =3.7.3e | |
Cisco IOS XE | =3.7.3s | |
Cisco IOS XE | =3.7.4as | |
Cisco IOS XE | =3.7.4e | |
Cisco IOS XE | =3.7.4s | |
Cisco IOS XE | =3.7.5e | |
Cisco IOS XE | =3.7.5s | |
Cisco IOS XE | =3.7.6s | |
Cisco IOS XE | =3.7.7s | |
Cisco IOS XE | =3.8.0e | |
Cisco IOS XE | =3.8.0s | |
Cisco IOS XE | =3.8.1e | |
Cisco IOS XE | =3.8.1s | |
Cisco IOS XE | =3.8.2e | |
Cisco IOS XE | =3.8.2s | |
Cisco IOS XE | =3.8.3e | |
Cisco IOS XE | =3.8.4e | |
Cisco IOS XE | =3.8.5ae | |
Cisco IOS XE | =3.8.5e | |
Cisco IOS XE | =3.8.6e | |
Cisco IOS XE | =3.8.7e | |
Cisco IOS XE | =3.8.8e | |
Cisco IOS XE | =3.8.9e | |
Cisco IOS XE | =3.8.10e | |
Cisco IOS XE | =3.8.10ee | |
Cisco IOS XE | =3.9.0as | |
Cisco IOS XE | =3.9.0e | |
Cisco IOS XE | =3.9.0s | |
Cisco IOS XE | =3.9.1as | |
Cisco IOS XE | =3.9.1e | |
Cisco IOS XE | =3.9.1s | |
Cisco IOS XE | =3.9.2e | |
Cisco IOS XE | =3.9.2s | |
Cisco IOS XE | =3.10.0ce | |
Cisco IOS XE | =3.10.0e | |
Cisco IOS XE | =3.10.0s | |
Cisco IOS XE | =3.10.1e | |
Cisco IOS XE | =3.10.1s | |
Cisco IOS XE | =3.10.1xbs | |
Cisco IOS XE | =3.10.2e | |
Cisco IOS XE | =3.10.2s | |
Cisco IOS XE | =3.10.2ts | |
Cisco IOS XE | =3.10.3e | |
Cisco IOS XE | =3.10.3s | |
Cisco IOS XE | =3.10.4s | |
Cisco IOS XE | =3.10.5s | |
Cisco IOS XE | =3.10.6s | |
Cisco IOS XE | =3.10.7s | |
Cisco IOS XE | =3.10.8as | |
Cisco IOS XE | =3.10.8s | |
Cisco IOS XE | =3.10.9s | |
Cisco IOS XE | =3.10.10s | |
Cisco IOS XE | =3.11.0e | |
Cisco IOS XE | =3.11.0s | |
Cisco IOS XE | =3.11.1ae | |
Cisco IOS XE | =3.11.1e | |
Cisco IOS XE | =3.11.1s | |
Cisco IOS XE | =3.11.2e | |
Cisco IOS XE | =3.11.2s | |
Cisco IOS XE | =3.11.3ae | |
Cisco IOS XE | =3.11.3e | |
Cisco IOS XE | =3.11.3s | |
Cisco IOS XE | =3.11.4e | |
Cisco IOS XE | =3.11.4s | |
Cisco IOS XE | =3.11.5e | |
Cisco IOS XE | =3.11.6e | |
Cisco IOS XE | =3.11.7e | |
Cisco IOS XE | =3.11.8e | |
Cisco IOS XE | =3.11.9e | |
Cisco IOS XE | =3.11.10e | |
Cisco IOS XE | =3.12.0as | |
Cisco IOS XE | =3.12.0s | |
Cisco IOS XE | =3.12.1s | |
Cisco IOS XE | =3.12.2s | |
Cisco IOS XE | =3.12.3s | |
Cisco IOS XE | =3.12.4s | |
Cisco IOS XE | =3.13.0as | |
Cisco IOS XE | =3.13.0s | |
Cisco IOS XE | =3.13.1s | |
Cisco IOS XE | =3.13.2as | |
Cisco IOS XE | =3.13.2s | |
Cisco IOS XE | =3.13.3s | |
Cisco IOS XE | =3.13.4s | |
Cisco IOS XE | =3.13.5as | |
Cisco IOS XE | =3.13.5s | |
Cisco IOS XE | =3.13.6as | |
Cisco IOS XE | =3.13.6s | |
Cisco IOS XE | =3.13.7as | |
Cisco IOS XE | =3.13.7s | |
Cisco IOS XE | =3.13.8s | |
Cisco IOS XE | =3.13.9s | |
Cisco IOS XE | =3.13.10s | |
Cisco IOS XE | =3.14.0s | |
Cisco IOS XE | =3.14.1s | |
Cisco IOS XE | =3.14.2s | |
Cisco IOS XE | =3.14.3s | |
Cisco IOS XE | =3.14.4s | |
Cisco IOS XE | =3.15.0s | |
Cisco IOS XE | =3.15.1cs | |
Cisco IOS XE | =3.15.1s | |
Cisco IOS XE | =3.15.2s | |
Cisco IOS XE | =3.15.3s | |
Cisco IOS XE | =3.15.4s | |
Cisco IOS XE | =3.16.0cs | |
Cisco IOS XE | =3.16.0s | |
Cisco IOS XE | =3.16.1as | |
Cisco IOS XE | =3.16.1s | |
Cisco IOS XE | =3.16.2as | |
Cisco IOS XE | =3.16.2bs | |
Cisco IOS XE | =3.16.2s | |
Cisco IOS XE | =3.16.3as | |
Cisco IOS XE | =3.16.3s | |
Cisco IOS XE | =3.16.4as | |
Cisco IOS XE | =3.16.4bs | |
Cisco IOS XE | =3.16.4ds | |
Cisco IOS XE | =3.16.4s | |
Cisco IOS XE | =3.16.5s | |
Cisco IOS XE | =3.16.6bs | |
Cisco IOS XE | =3.16.6s | |
Cisco IOS XE | =3.16.7as | |
Cisco IOS XE | =3.16.7bs | |
Cisco IOS XE | =3.16.7s | |
Cisco IOS XE | =3.16.8s | |
Cisco IOS XE | =3.16.9s | |
Cisco IOS XE | =3.16.10s | |
Cisco IOS XE | =3.17.0s | |
Cisco IOS XE | =3.17.1as | |
Cisco IOS XE | =3.17.1s | |
Cisco IOS XE | =3.17.2s | |
Cisco IOS XE | =3.17.3s | |
Cisco IOS XE | =3.17.4s | |
Cisco IOS XE | =3.18.0as | |
Cisco IOS XE | =3.18.0s | |
Cisco IOS XE | =3.18.0sp | |
Cisco IOS XE | =3.18.1asp | |
Cisco IOS XE | =3.18.1bsp | |
Cisco IOS XE | =3.18.1csp | |
Cisco IOS XE | =3.18.1s | |
Cisco IOS XE | =3.18.1sp | |
Cisco IOS XE | =3.18.2asp | |
Cisco IOS XE | =3.18.2s | |
Cisco IOS XE | =3.18.2sp | |
Cisco IOS XE | =3.18.3asp | |
Cisco IOS XE | =3.18.3bsp | |
Cisco IOS XE | =3.18.3s | |
Cisco IOS XE | =3.18.3sp | |
Cisco IOS XE | =3.18.4s | |
Cisco IOS XE | =3.18.4sp | |
Cisco IOS XE | =3.18.5sp | |
Cisco IOS XE | =3.18.6sp | |
Cisco IOS XE | =3.18.7sp | |
Cisco IOS XE | =3.18.8asp | |
Cisco IOS XE | =3.18.9sp | |
Cisco IOS XE | =16.1.1 | |
Cisco IOS XE | =16.1.2 | |
Cisco IOS XE | =16.1.3 | |
Cisco IOS XE | =16.2.1 | |
Cisco IOS XE | =16.2.2 | |
Cisco IOS XE | =16.3.1 | |
Cisco IOS XE | =16.3.1a | |
Cisco IOS XE | =16.3.2 | |
Cisco IOS XE | =16.3.3 | |
Cisco IOS XE | =16.3.4 | |
Cisco IOS XE | =16.3.5 | |
Cisco IOS XE | =16.3.5b | |
Cisco IOS XE | =16.3.6 | |
Cisco IOS XE | =16.3.7 | |
Cisco IOS XE | =16.3.8 | |
Cisco IOS XE | =16.3.9 | |
Cisco IOS XE | =16.3.10 | |
Cisco IOS XE | =16.3.11 | |
Cisco IOS XE | =16.4.1 | |
Cisco IOS XE | =16.4.2 | |
Cisco IOS XE | =16.4.3 | |
Cisco IOS XE | =16.5.1 | |
Cisco IOS XE | =16.5.1a | |
Cisco IOS XE | =16.5.1b | |
Cisco IOS XE | =16.5.2 | |
Cisco IOS XE | =16.5.3 | |
Cisco IOS XE | =16.6.1 | |
Cisco IOS XE | =16.6.2 | |
Cisco IOS XE | =16.6.3 | |
Cisco IOS XE | =16.6.4 | |
Cisco IOS XE | =16.6.4a | |
Cisco IOS XE | =16.6.5 | |
Cisco IOS XE | =16.6.5a | |
Cisco IOS XE | =16.6.6 | |
Cisco IOS XE | =16.6.7 | |
Cisco IOS XE | =16.6.8 | |
Cisco IOS XE | =16.6.9 | |
Cisco IOS XE | =16.6.10 | |
Cisco IOS XE | =16.7.1 | |
Cisco IOS XE | =16.7.1a | |
Cisco IOS XE | =16.7.1b | |
Cisco IOS XE | =16.7.2 | |
Cisco IOS XE | =16.7.3 | |
Cisco IOS XE | =16.7.4 | |
Cisco IOS XE | =16.8.1 | |
Cisco IOS XE | =16.8.1a | |
Cisco IOS XE | =16.8.1b | |
Cisco IOS XE | =16.8.1c | |
Cisco IOS XE | =16.8.1d | |
Cisco IOS XE | =16.8.1e | |
Cisco IOS XE | =16.8.1s | |
Cisco IOS XE | =16.8.2 | |
Cisco IOS XE | =16.8.3 | |
Cisco IOS XE | =16.9.1 | |
Cisco IOS XE | =16.9.1a | |
Cisco IOS XE | =16.9.1b | |
Cisco IOS XE | =16.9.1s | |
Cisco IOS XE | =16.9.2 | |
Cisco IOS XE | =16.9.3 | |
Cisco IOS XE | =16.9.3a | |
Cisco IOS XE | =16.9.4 | |
Cisco IOS XE | =16.9.5 | |
Cisco IOS XE | =16.9.5f | |
Cisco IOS XE | =16.9.6 | |
Cisco IOS XE | =16.9.7 | |
Cisco IOS XE | =16.9.8 | |
Cisco IOS XE | =16.10.1 | |
Cisco IOS XE | =16.10.1a | |
Cisco IOS XE | =16.10.1b | |
Cisco IOS XE | =16.10.1c | |
Cisco IOS XE | =16.10.1d | |
Cisco IOS XE | =16.10.1e | |
Cisco IOS XE | =16.10.1f | |
Cisco IOS XE | =16.10.1g | |
Cisco IOS XE | =16.10.1s | |
Cisco IOS XE | =16.10.2 | |
Cisco IOS XE | =16.10.3 | |
Cisco IOS XE | =16.11.1 | |
Cisco IOS XE | =16.11.1a | |
Cisco IOS XE | =16.11.1b | |
Cisco IOS XE | =16.11.1s | |
Cisco IOS XE | =16.11.2 | |
Cisco IOS XE | =16.12.1 | |
Cisco IOS XE | =16.12.1a | |
Cisco IOS XE | =16.12.1c | |
Cisco IOS XE | =16.12.1s | |
Cisco IOS XE | =16.12.1t | |
Cisco IOS XE | =16.12.1w | |
Cisco IOS XE | =16.12.1x | |
Cisco IOS XE | =16.12.1y | |
Cisco IOS XE | =16.12.1z1 | |
Cisco IOS XE | =16.12.1z2 | |
Cisco IOS XE | =16.12.2 | |
Cisco IOS XE | =16.12.2a | |
Cisco IOS XE | =16.12.2s | |
Cisco IOS XE | =16.12.3 | |
Cisco IOS XE | =16.12.3a | |
Cisco IOS XE | =16.12.3s | |
Cisco IOS XE | =16.12.4 | |
Cisco IOS XE | =16.12.4a | |
Cisco IOS XE | =16.12.5 | |
Cisco IOS XE | =16.12.5a | |
Cisco IOS XE | =16.12.5b | |
Cisco IOS XE | =16.12.6 | |
Cisco IOS XE | =16.12.6a | |
Cisco IOS XE | =16.12.7 | |
Cisco IOS XE | =16.12.8 | |
Cisco IOS XE | =16.12.9 | |
Cisco IOS XE | =16.12.10 | |
Cisco IOS XE | =16.12.10a | |
Cisco IOS XE | =16.12.11 | |
Cisco IOS XE | =17.1.1 | |
Cisco IOS XE | =17.1.1a | |
Cisco IOS XE | =17.1.1s | |
Cisco IOS XE | =17.1.1t | |
Cisco IOS XE | =17.1.3 | |
Cisco IOS XE | =17.2.1 | |
Cisco IOS XE | =17.2.1a | |
Cisco IOS XE | =17.2.1r | |
Cisco IOS XE | =17.2.1v | |
Cisco IOS XE | =17.2.2 | |
Cisco IOS XE | =17.2.3 | |
Cisco IOS XE | =17.3.1 | |
Cisco IOS XE | =17.3.1a | |
Cisco IOS XE | =17.3.1w | |
Cisco IOS XE | =17.3.1x | |
Cisco IOS XE | =17.3.1z | |
Cisco IOS XE | =17.3.2 | |
Cisco IOS XE | =17.3.2a | |
Cisco IOS XE | =17.3.3 | |
Cisco IOS XE | =17.3.4 | |
Cisco IOS XE | =17.3.4a | |
Cisco IOS XE | =17.3.4b | |
Cisco IOS XE | =17.3.4c | |
Cisco IOS XE | =17.3.5 | |
Cisco IOS XE | =17.3.5a | |
Cisco IOS XE | =17.3.5b | |
Cisco IOS XE | =17.3.6 | |
Cisco IOS XE | =17.3.7 | |
Cisco IOS XE | =17.3.8 | |
Cisco IOS XE | =17.3.8a | |
Cisco IOS XE | =17.4.1 | |
Cisco IOS XE | =17.4.1a | |
Cisco IOS XE | =17.4.1b | |
Cisco IOS XE | =17.4.2 | |
Cisco IOS XE | =17.4.2a | |
Cisco IOS XE | =17.5.1 | |
Cisco IOS XE | =17.5.1a | |
Cisco IOS XE | =17.6.1 | |
Cisco IOS XE | =17.6.1a | |
Cisco IOS XE | =17.6.1w | |
Cisco IOS XE | =17.6.1x | |
Cisco IOS XE | =17.6.1y | |
Cisco IOS XE | =17.6.1z | |
Cisco IOS XE | =17.6.1z1 | |
Cisco IOS XE | =17.6.2 | |
Cisco IOS XE | =17.6.3 | |
Cisco IOS XE | =17.6.3a | |
Cisco IOS XE | =17.6.4 | |
Cisco IOS XE | =17.6.5 | |
Cisco IOS XE | =17.6.5a | |
Cisco IOS XE | =17.6.6 | |
Cisco IOS XE | =17.6.6a | |
Cisco IOS XE | =17.6.7 | |
Cisco IOS XE | =17.7.1 | |
Cisco IOS XE | =17.7.1a | |
Cisco IOS XE | =17.7.1b | |
Cisco IOS XE | =17.7.2 | |
Cisco IOS XE | =17.8.1 | |
Cisco IOS XE | =17.8.1a | |
Cisco IOS XE | =17.9.1 | |
Cisco IOS XE | =17.9.1a | |
Cisco IOS XE | =17.9.1w | |
Cisco IOS XE | =17.9.1x | |
Cisco IOS XE | =17.9.1x1 | |
Cisco IOS XE | =17.9.1y | |
Cisco IOS XE | =17.9.1y1 | |
Cisco IOS XE | =17.9.2 | |
Cisco IOS XE | =17.9.2a | |
Cisco IOS XE | =17.9.3 | |
Cisco IOS XE | =17.9.3a | |
Cisco IOS XE | =17.9.4 | |
Cisco IOS XE | =17.9.4a | |
Cisco IOS XE | =17.9.5 | |
Cisco IOS XE | =17.9.5a | |
Cisco IOS XE | =17.9.5b | |
Cisco IOS XE | =17.10.1 | |
Cisco IOS XE | =17.10.1a | |
Cisco IOS XE | =17.10.1b | |
Cisco IOS XE | =17.11.1 | |
Cisco IOS XE | =17.11.1a | |
Cisco IOS XE | =17.11.99sw | |
Cisco IOS XE | =17.12.1 | |
Cisco IOS XE | =17.12.1a | |
Cisco IOS XE | =17.12.1w | |
Cisco IOS XE | =17.12.1x | |
Cisco IOS XE | =17.12.1y | |
Cisco IOS XE | =17.12.2 | |
Cisco IOS XE | =17.12.2a | |
Cisco IOS XE | =17.12.3 | |
Cisco IOS XE | =17.12.3a | |
Cisco IOS XE | =17.13.1 | |
Cisco IOS XE | =17.13.1a | |
Cisco IOS | =15.2\(6\)e2 | |
Cisco IOS | =15.2\(6\)e2a | |
Cisco IOS | =15.2\(6\)e2b | |
Cisco IOS | =15.2\(6\)e3 | |
Cisco IOS | =15.2\(6\)eb | |
Cisco IOS | =15.2\(7\)e | |
Cisco IOS | =15.2\(7\)e0a | |
Cisco IOS | =15.2\(7\)e0b | |
Cisco IOS | =15.2\(7\)e0s | |
Cisco IOS | =15.2\(7\)e1 | |
Cisco IOS | =15.2\(7\)e1a | |
Cisco IOS | =15.2\(7\)e2 | |
Cisco IOS | =15.2\(7\)e2a | |
Cisco IOS | =15.2\(7\)e3 | |
Cisco IOS | =15.2\(7\)e3k | |
Cisco IOS | =15.2\(7\)e4 | |
Cisco IOS | =15.2\(7\)e5 | |
Cisco IOS | =15.2\(7\)e6 | |
Cisco IOS | =15.2\(7\)e7 | |
Cisco IOS | =15.2\(7\)e8 | |
Cisco IOS | =15.2\(7\)e9 | |
Cisco IOS | =15.2\(7\)e10 | |
Cisco IOS | =15.2\(7a\)e0b | |
Cisco IOS | =15.2\(7b\)e0b | |
Cisco IOS | =15.2\(8\)e | |
Cisco IOS | =15.2\(8\)e1 | |
Cisco IOS | =15.2\(8\)e2 | |
Cisco IOS | =15.2\(8\)e3 | |
Cisco IOS | =15.2\(8\)e4 | |
Cisco IOS | =15.2\(8\)e5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2024-20414 is classified as high due to its potential for cross-site request forgery (CSRF) exploitation.
To fix CVE-2024-20414, it's recommended to upgrade to a patched version of the affected Cisco IOS or Cisco IOS XE software.
CVE-2024-20414 affects multiple versions of Cisco IOS and IOS XE, including 3.2.0se to 3.13.x and various versions of IOS XE from 16.1.1 up to 17.12.3.
CVE-2024-20414 can facilitate a cross-site request forgery (CSRF) attack, allowing an unauthenticated remote attacker to manipulate the affected system.
No, user authentication is not required to exploit CVE-2024-20414, which increases its potential risk.