Attacker Could Redirect Users to Malicious Web Page via Cisco Expressway Series Vulnerability

CVE-2024-20400

Summary

A vulnerability exists in the web-based management interface of Cisco Expressway Series that permits an unauthenticated remote attacker to reroute a user to a malicious web page. The flaw arises from ineffective validation of HTTP request parameters, enabling an attacker to intercept and alter requests from users. Exploitation of this vulnerability could lead to unintended user redirection, potentially compromising user data and security. The affected components include Cisco Expressway Control (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices, highlighting the need for immediate action to secure these platforms.

References