CVE-2024-20437: CSRF
First published: Wed Sep 25 2024(Updated: )
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack and execute commands on the CLI of an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an already authenticated user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Software | =17.3.2 | |
| Cisco IOS XE Software | =17.3.2a | |
| Cisco IOS XE Software | =17.3.3 | |
| Cisco IOS XE Software | =17.3.4 | |
| Cisco IOS XE Software | =17.3.4a | |
| Cisco IOS XE Software | =17.3.4b | |
| Cisco IOS XE Software | =17.3.4c | |
| Cisco IOS XE Software | =17.3.5 | |
| Cisco IOS XE Software | =17.3.5a | |
| Cisco IOS XE Software | =17.3.5b | |
| Cisco IOS XE Software | =17.3.6 | |
| Cisco IOS XE Software | =17.3.7 | |
| Cisco IOS XE Software | =17.3.8 | |
| Cisco IOS XE Software | =17.3.8a | |
| Cisco IOS XE Software | =17.4.1 | |
| Cisco IOS XE Software | =17.4.1a | |
| Cisco IOS XE Software | =17.4.1b | |
| Cisco IOS XE Software | =17.4.2 | |
| Cisco IOS XE Software | =17.4.2a | |
| Cisco IOS XE Software | =17.5.1 | |
| Cisco IOS XE Software | =17.5.1a | |
| Cisco IOS XE Software | =17.6.1 | |
| Cisco IOS XE Software | =17.6.1a | |
| Cisco IOS XE Software | =17.6.1w | |
| Cisco IOS XE Software | =17.6.1x | |
| Cisco IOS XE Software | =17.6.1y | |
| Cisco IOS XE Software | =17.6.1z | |
| Cisco IOS XE Software | =17.6.1z1 | |
| Cisco IOS XE Software | =17.6.2 | |
| Cisco IOS XE Software | =17.6.3 | |
| Cisco IOS XE Software | =17.6.3a | |
| Cisco IOS XE Software | =17.6.4 | |
| Cisco IOS XE Software | =17.6.5 | |
| Cisco IOS XE Software | =17.6.5a | |
| Cisco IOS XE Software | =17.6.6 | |
| Cisco IOS XE Software | =17.6.6a | |
| Cisco IOS XE Software | =17.7.1 | |
| Cisco IOS XE Software | =17.7.1a | |
| Cisco IOS XE Software | =17.7.1b | |
| Cisco IOS XE Software | =17.7.2 | |
| Cisco IOS XE Software | =17.8.1 | |
| Cisco IOS XE Software | =17.8.1a | |
| Cisco IOS XE Software | =17.9.1 | |
| Cisco IOS XE Software | =17.9.1a | |
| Cisco IOS XE Software | =17.9.1w | |
| Cisco IOS XE Software | =17.9.1x | |
| Cisco IOS XE Software | =17.9.1x1 | |
| Cisco IOS XE Software | =17.9.1y | |
| Cisco IOS XE Software | =17.9.1y1 | |
| Cisco IOS XE Software | =17.9.2 | |
| Cisco IOS XE Software | =17.9.2a | |
| Cisco IOS XE Software | =17.9.3 | |
| Cisco IOS XE Software | =17.9.3a | |
| Cisco IOS XE Software | =17.9.4 | |
| Cisco IOS XE Software | =17.9.4a | |
| Cisco IOS XE Software | =17.10.1 | |
| Cisco IOS XE Software | =17.10.1a | |
| Cisco IOS XE Software | =17.10.1b | |
| Cisco IOS XE Software | =17.11.1 | |
| Cisco IOS XE Software | =17.11.1a | |
| Cisco IOS XE Software | =17.11.99sw | |
| Cisco IOS XE Software | =17.12.1 | |
| Cisco IOS XE Software | =17.12.1a | |
| Cisco IOS XE Software | =17.12.1w | |
| Cisco IOS XE Software | =17.12.1x | |
| Cisco IOS XE Software | =17.12.1y |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20437?
CVE-2024-20437 has been assigned a severity rating of high due to the potential for remote command execution via CSRF.
How do I fix CVE-2024-20437?
To mitigate CVE-2024-20437, upgrade Cisco IOS XE Software to a fixed version provided by Cisco.
Who is affected by CVE-2024-20437?
CVE-2024-20437 affects devices running specific versions of Cisco IOS XE Software that lack sufficient CSRF protections.
What is the impact of CVE-2024-20437?
The impact of CVE-2024-20437 is that an unauthenticated remote attacker can potentially execute arbitrary commands on affected devices.
Is there a workaround for CVE-2024-20437?
Currently, there are no documented workarounds for CVE-2024-20437 apart from applying the recommended updates from Cisco.
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/17.3.2
- version/cisco ios xe/17.3.2a
- version/cisco ios xe/17.3.3
- version/cisco ios xe/17.3.4
- version/cisco ios xe/17.3.4a
- version/cisco ios xe/17.3.4b
- version/cisco ios xe/17.3.4c
- version/cisco ios xe/17.3.5
- version/cisco ios xe/17.3.5a
- version/cisco ios xe/17.3.5b
- version/cisco ios xe/17.3.6
- version/cisco ios xe/17.3.7
- version/cisco ios xe/17.3.8
- version/cisco ios xe/17.3.8a
- version/cisco ios xe/17.4.1
- version/cisco ios xe/17.4.1a
- version/cisco ios xe/17.4.1b
- version/cisco ios xe/17.4.2
- version/cisco ios xe/17.4.2a
- version/cisco ios xe/17.5.1
- version/cisco ios xe/17.5.1a
- version/cisco ios xe/17.6.1
- version/cisco ios xe/17.6.1a
- version/cisco ios xe/17.6.1w
- version/cisco ios xe/17.6.1x
- version/cisco ios xe/17.6.1y
- version/cisco ios xe/17.6.1z
- version/cisco ios xe/17.6.1z1
- version/cisco ios xe/17.6.2
- version/cisco ios xe/17.6.3
- version/cisco ios xe/17.6.3a
- version/cisco ios xe/17.6.4
- version/cisco ios xe/17.6.5
- version/cisco ios xe/17.6.5a
- version/cisco ios xe/17.6.6
- version/cisco ios xe/17.6.6a
- version/cisco ios xe/17.7.1
- version/cisco ios xe/17.7.1a
- version/cisco ios xe/17.7.1b
- version/cisco ios xe/17.7.2
- version/cisco ios xe/17.8.1
- version/cisco ios xe/17.8.1a
- version/cisco ios xe/17.9.1
- version/cisco ios xe/17.9.1a
- version/cisco ios xe/17.9.1w
- version/cisco ios xe/17.9.1x
- version/cisco ios xe/17.9.1x1
- version/cisco ios xe/17.9.1y
- version/cisco ios xe/17.9.1y1
- version/cisco ios xe/17.9.2
- version/cisco ios xe/17.9.2a
- version/cisco ios xe/17.9.3
- version/cisco ios xe/17.9.3a
- version/cisco ios xe/17.9.4
- version/cisco ios xe/17.9.4a
- version/cisco ios xe/17.10.1
- version/cisco ios xe/17.10.1a
- version/cisco ios xe/17.10.1b
- version/cisco ios xe/17.11.1
- version/cisco ios xe/17.11.1a
- version/cisco ios xe/17.11.99sw
- version/cisco ios xe/17.12.1
- version/cisco ios xe/17.12.1a
- version/cisco ios xe/17.12.1w
- version/cisco ios xe/17.12.1x
- version/cisco ios xe/17.12.1y