CVE-2024-20414
Published: Sep 25, 2024Modified: Jun 17, 2026
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD
Description
A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI.
This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.
Affected (461)
Configuration A431 vulnerable
| Vulnerable Software | Affected Versions |
|---|---|
| Version 16.1.1 | |
| Version 16.1.2 | |
| Version 16.1.3 | |
| Version 16.10.1 | |
| Version 16.10.1a | |
| Version 16.10.1b | |
| Version 16.10.1c | |
| Version 16.10.1d | |
| Version 16.10.1e | |
| Version 16.10.1f | |
| Version 16.10.1g | |
| Version 16.10.1s | |
| Version 16.10.2 | |
| Version 16.10.3 | |
| Version 16.11.1 | |
| Version 16.11.1a | |
| Version 16.11.1b | |
| Version 16.11.1s | |
| Version 16.11.2 | |
| Version 16.12.10 | |
| Version 16.12.10a | |
| Version 16.12.11 | |
| Version 16.12.1 | |
| Version 16.12.1a | |
| Version 16.12.1c | |
| Version 16.12.1s | |
| Version 16.12.1t | |
| Version 16.12.1w | |
| Version 16.12.1x | |
| Version 16.12.1y | |
| Version 16.12.1z1 | |
| Version 16.12.1z2 | |
| Version 16.12.2 | |
| Version 16.12.2a | |
| Version 16.12.2s | |
| Version 16.12.3 | |
| Version 16.12.3a | |
| Version 16.12.3s | |
| Version 16.12.4 | |
| Version 16.12.4a | |
| Version 16.12.5 | |
| Version 16.12.5a | |
| Version 16.12.5b | |
| Version 16.12.6 | |
| Version 16.12.6a | |
| Version 16.12.7 | |
| Version 16.12.8 | |
| Version 16.12.9 | |
| Version 16.2.1 | |
| Version 16.2.2 | |
| Version 16.3.10 | |
| Version 16.3.11 | |
| Version 16.3.1 | |
| Version 16.3.1a | |
| Version 16.3.2 | |
| Version 16.3.3 | |
| Version 16.3.4 | |
| Version 16.3.5 | |
| Version 16.3.5b | |
| Version 16.3.6 | |
| Version 16.3.7 | |
| Version 16.3.8 | |
| Version 16.3.9 | |
| Version 16.4.1 | |
| Version 16.4.2 | |
| Version 16.4.3 | |
| Version 16.5.1 | |
| Version 16.5.1a | |
| Version 16.5.1b | |
| Version 16.5.2 | |
| Version 16.5.3 | |
| Version 16.6.10 | |
| Version 16.6.1 | |
| Version 16.6.2 | |
| Version 16.6.3 | |
| Version 16.6.4 | |
| Version 16.6.4a | |
| Version 16.6.5 | |
| Version 16.6.5a | |
| Version 16.6.6 | |
| Version 16.6.7 | |
| Version 16.6.8 | |
| Version 16.6.9 | |
| Version 16.7.1 | |
| Version 16.7.1a | |
| Version 16.7.1b | |
| Version 16.7.2 | |
| Version 16.7.3 | |
| Version 16.7.4 | |
| Version 16.8.1 | |
| Version 16.8.1a | |
| Version 16.8.1b | |
| Version 16.8.1c | |
| Version 16.8.1d | |
| Version 16.8.1e | |
| Version 16.8.1s | |
| Version 16.8.2 | |
| Version 16.8.3 | |
| Version 16.9.1 | |
| Version 16.9.1a | |
| Version 16.9.1b | |
| Version 16.9.1s | |
| Version 16.9.2 | |
| Version 16.9.3 | |
| Version 16.9.3a | |
| Version 16.9.4 | |
| Version 16.9.5 | |
| Version 16.9.5f | |
| Version 16.9.6 | |
| Version 16.9.7 | |
| Version 16.9.8 | |
| Version 17.1.1 | |
| Version 17.1.1a | |
| Version 17.1.1s | |
| Version 17.1.1t | |
| Version 17.1.3 | |
| Version 17.10.1 | |
| Version 17.10.1a | |
| Version 17.10.1b | |
| Version 17.11.1 | |
| Version 17.11.1a | |
| Version 17.11.99sw | |
| Version 17.12.1 | |
| Version 17.12.1a | |
| Version 17.12.1w | |
| Version 17.12.1x | |
| Version 17.12.1y | |
| Version 17.12.2 | |
| Version 17.12.2a | |
| Version 17.12.3 | |
| Version 17.12.3a | |
| Version 17.13.1 | |
| Version 17.13.1a | |
| Version 17.2.1 | |
| Version 17.2.1a | |
| Version 17.2.1r | |
| Version 17.2.1v | |
| Version 17.2.2 | |
| Version 17.2.3 | |
| Version 17.3.1 | |
| Version 17.3.1a | |
| Version 17.3.1w | |
| Version 17.3.1x | |
| Version 17.3.1z | |
| Version 17.3.2 | |
| Version 17.3.2a | |
| Version 17.3.3 | |
| Version 17.3.4 | |
| Version 17.3.4a | |
| Version 17.3.4b | |
| Version 17.3.4c | |
| Version 17.3.5 | |
| Version 17.3.5a | |
| Version 17.3.5b | |
| Version 17.3.6 | |
| Version 17.3.7 | |
| Version 17.3.8 | |
| Version 17.3.8a | |
| Version 17.4.1 | |
| Version 17.4.1a | |
| Version 17.4.1b | |
| Version 17.4.2 | |
| Version 17.4.2a | |
| Version 17.5.1 | |
| Version 17.5.1a | |
| Version 17.6.1 | |
| Version 17.6.1a | |
| Version 17.6.1w | |
| Version 17.6.1x | |
| Version 17.6.1y | |
| Version 17.6.1z1 | |
| Version 17.6.1z | |
| Version 17.6.2 | |
| Version 17.6.3 | |
| Version 17.6.3a | |
| Version 17.6.4 | |
| Version 17.6.5 | |
| Version 17.6.5a | |
| Version 17.6.6 | |
| Version 17.6.6a | |
| Version 17.6.7 | |
| Version 17.7.1 | |
| Version 17.7.1a | |
| Version 17.7.1b | |
| Version 17.7.2 | |
| Version 17.8.1 | |
| Version 17.8.1a | |
| Version 17.9.1 | |
| Version 17.9.1a | |
| Version 17.9.1w | |
| Version 17.9.1x1 | |
| Version 17.9.1x | |
| Version 17.9.1y1 | |
| Version 17.9.1y | |
| Version 17.9.2 | |
| Version 17.9.2a | |
| Version 17.9.3 | |
| Version 17.9.3a | |
| Version 17.9.4 | |
| Version 17.9.4a | |
| Version 17.9.5 | |
| Version 17.9.5a | |
| Version 17.9.5b | |
| Version 3.10.0ce | |
| Version 3.10.0e | |
| Version 3.10.0s | |
| Version 3.10.10s | |
| Version 3.10.1e | |
| Version 3.10.1s | |
| Version 3.10.1xbs | |
| Version 3.10.2e | |
| Version 3.10.2s | |
| Version 3.10.2ts | |
| Version 3.10.3e | |
| Version 3.10.3s | |
| Version 3.10.4s | |
| Version 3.10.5s | |
| Version 3.10.6s | |
| Version 3.10.7s | |
| Version 3.10.8as | |
| Version 3.10.8s | |
| Version 3.10.9s | |
| Version 3.11.0e | |
| Version 3.11.0s | |
| Version 3.11.10e | |
| Version 3.11.1ae | |
| Version 3.11.1e | |
| Version 3.11.1s | |
| Version 3.11.2e | |
| Version 3.11.2s | |
| Version 3.11.3ae | |
| Version 3.11.3e | |
| Version 3.11.3s | |
| Version 3.11.4e | |
| Version 3.11.4s | |
| Version 3.11.5e | |
| Version 3.11.6e | |
| Version 3.11.7e | |
| Version 3.11.8e | |
| Version 3.11.9e | |
| Version 3.12.0as | |
| Version 3.12.0s | |
| Version 3.12.1s | |
| Version 3.12.2s | |
| Version 3.12.3s | |
| Version 3.12.4s | |
| Version 3.13.0as | |
| Version 3.13.0s | |
| Version 3.13.10s | |
| Version 3.13.1s | |
| Version 3.13.2as | |
| Version 3.13.2s | |
| Version 3.13.3s | |
| Version 3.13.4s | |
| Version 3.13.5as | |
| Version 3.13.5s | |
| Version 3.13.6as | |
| Version 3.13.6s | |
| Version 3.13.7as | |
| Version 3.13.7s | |
| Version 3.13.8s | |
| Version 3.13.9s | |
| Version 3.14.0s | |
| Version 3.14.1s | |
| Version 3.14.2s | |
| Version 3.14.3s | |
| Version 3.14.4s | |
| Version 3.15.0s | |
| Version 3.15.1cs | |
| Version 3.15.1s | |
| Version 3.15.2s | |
| Version 3.15.3s | |
| Version 3.15.4s | |
| Version 3.16.0cs | |
| Version 3.16.0s | |
| Version 3.16.10s | |
| Version 3.16.1as | |
| Version 3.16.1s | |
| Version 3.16.2as | |
| Version 3.16.2bs | |
| Version 3.16.2s | |
| Version 3.16.3as | |
| Version 3.16.3s | |
| Version 3.16.4as | |
| Version 3.16.4bs | |
| Version 3.16.4ds | |
| Version 3.16.4s | |
| Version 3.16.5s | |
| Version 3.16.6bs | |
| Version 3.16.6s | |
| Version 3.16.7as | |
| Version 3.16.7bs | |
| Version 3.16.7s | |
| Version 3.16.8s | |
| Version 3.16.9s | |
| Version 3.17.0s | |
| Version 3.17.1as | |
| Version 3.17.1s | |
| Version 3.17.2s | |
| Version 3.17.3s | |
| Version 3.17.4s | |
| Version 3.18.0as | |
| Version 3.18.0s | |
| Version 3.18.0sp | |
| Version 3.18.1asp | |
| Version 3.18.1bsp | |
| Version 3.18.1csp | |
| Version 3.18.1s | |
| Version 3.18.1sp | |
| Version 3.18.2asp | |
| Version 3.18.2s | |
| Version 3.18.2sp | |
| Version 3.18.3asp | |
| Version 3.18.3bsp | |
| Version 3.18.3s | |
| Version 3.18.3sp | |
| Version 3.18.4s | |
| Version 3.18.4sp | |
| Version 3.18.5sp | |
| Version 3.18.6sp | |
| Version 3.18.7sp | |
| Version 3.18.8asp | |
| Version 3.18.9sp | |
| Version 3.2.0se | |
| Version 3.2.0sg | |
| Version 3.2.10sg | |
| Version 3.2.11sg | |
| Version 3.2.1se | |
| Version 3.2.1sg | |
| Version 3.2.2se | |
| Version 3.2.2sg | |
| Version 3.2.3se | |
| Version 3.2.3sg | |
| Version 3.2.4sg | |
| Version 3.2.5sg | |
| Version 3.2.6sg | |
| Version 3.2.7sg | |
| Version 3.2.8sg | |
| Version 3.2.9sg | |
| Version 3.3.0se | |
| Version 3.3.0sg | |
| Version 3.3.0sq | |
| Version 3.3.1se | |
| Version 3.3.1sg | |
| Version 3.3.1sq | |
| Version 3.3.2se | |
| Version 3.3.2sg | |
| Version 3.3.3se | |
| Version 3.3.4se | |
| Version 3.3.5se | |
| Version 3.4.0sg | |
| Version 3.4.0sq | |
| Version 3.4.1sg | |
| Version 3.4.1sq | |
| Version 3.4.2sg | |
| Version 3.4.3sg | |
| Version 3.4.4sg | |
| Version 3.4.5sg | |
| Version 3.4.6sg | |
| Version 3.4.7sg | |
| Version 3.4.8sg | |
| Version 3.5.0e | |
| Version 3.5.0sq | |
| Version 3.5.1e | |
| Version 3.5.1sq | |
| Version 3.5.2e | |
| Version 3.5.2sq | |
| Version 3.5.3e | |
| Version 3.5.3sq | |
| Version 3.5.4sq | |
| Version 3.5.5sq | |
| Version 3.5.6sq | |
| Version 3.5.7sq | |
| Version 3.5.8sq | |
| Version 3.6.0e | |
| Version 3.6.10e | |
| Version 3.6.1e | |
| Version 3.6.2ae | |
| Version 3.6.2e | |
| Version 3.6.3e | |
| Version 3.6.4e | |
| Version 3.6.5ae | |
| Version 3.6.5be | |
| Version 3.6.5e | |
| Version 3.6.6e | |
| Version 3.6.7be | |
| Version 3.6.7e | |
| Version 3.6.8e | |
| Version 3.6.9e | |
| Version 3.7.0bs | |
| Version 3.7.0e | |
| Version 3.7.0s | |
| Version 3.7.1as | |
| Version 3.7.1e | |
| Version 3.7.1s | |
| Version 3.7.2e | |
| Version 3.7.2s | |
| Version 3.7.2ts | |
| Version 3.7.3e | |
| Version 3.7.3s | |
| Version 3.7.4as | |
| Version 3.7.4e | |
| Version 3.7.4s | |
| Version 3.7.5e | |
| Version 3.7.5s | |
| Version 3.7.6s | |
| Version 3.7.7s | |
| Version 3.8.0e | |
| Version 3.8.0s | |
| Version 3.8.10e | |
| Version 3.8.10ee | |
| Version 3.8.1e | |
| Version 3.8.1s | |
| Version 3.8.2e | |
| Version 3.8.2s | |
| Version 3.8.3e | |
| Version 3.8.4e | |
| Version 3.8.5ae | |
| Version 3.8.5e | |
| Version 3.8.6e | |
| Version 3.8.7e | |
| Version 3.8.8e | |
| Version 3.8.9e | |
| Version 3.9.0as | |
| Version 3.9.0e | |
| Version 3.9.0s | |
| Version 3.9.1as | |
| Version 3.9.1e | |
| Version 3.9.1s | |
| Version 3.9.2e | |
| Version 3.9.2s |
Configuration B30 vulnerable
| Vulnerable Software | Affected Versions |
|---|---|
| Version 15.2(6)e2 | |
| Version 15.2(6)e2a | |
| Version 15.2(6)e2b | |
| Version 15.2(6)e3 | |
| Version 15.2(6)eb | |
| Version 15.2(7)e0a | |
| Version 15.2(7)e0b | |
| Version 15.2(7)e0s | |
| Version 15.2(7)e10 | |
| Version 15.2(7)e1 | |
| Version 15.2(7)e1a | |
| Version 15.2(7)e2 | |
| Version 15.2(7)e2a | |
| Version 15.2(7)e3 | |
| Version 15.2(7)e3k | |
| Version 15.2(7)e4 | |
| Version 15.2(7)e5 | |
| Version 15.2(7)e6 | |
| Version 15.2(7)e7 | |
| Version 15.2(7)e8 | |
| Version 15.2(7)e9 | |
| Version 15.2(7)e | |
| Version 15.2(7a)e0b | |
| Version 15.2(7b)e0b | |
| Version 15.2(8)e1 | |
| Version 15.2(8)e2 | |
| Version 15.2(8)e3 | |
| Version 15.2(8)e4 | |
| Version 15.2(8)e5 | |
| Version 15.2(8)e |
Related CWEs
CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
References (1)
Source: psirt@cisco.com
Vendor Advisory
Timeline
No history available yet.