Log in Start free

Vulnerability · Published Apr 3, 2024 · Assigned by cisco

CVE-2024-20352

Medium 4.9

In plain English

A medium-severity security flaw in Cisco Emergency Responder from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)1.5%top 26.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An attacker could exploit this vulnerability by sending crafted requests to the web UI. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user, such as accessing password or log files or uploading and deleting existing files from the system.

Affected products (as reported)

VendorProductVersions
Cisco Cisco Emergency Responder 10.5(1a)10.5(1)11.5(4)SU211.5(4)SU411.5(4)SU311.5(1)11.5(3)11.5(2)

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References