CVE-2024-20414: A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS X

Description

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco IOS

15.2(6)E2affected
15.2(7)Eaffected
15.2(6)E2aaffected
15.2(6)E2baffected
15.2(7)E1affected
15.2(7)E0aaffected
15.2(7)E0baffected
15.2(7)E0saffected
15.2(6)E3affected
15.2(7)E2affected
15.2(7a)E0baffected
15.2(7)E3affected
15.2(7)E1aaffected
15.2(7b)E0baffected
15.2(7)E2aaffected
15.2(7)E4affected
15.2(7)E3kaffected
15.2(8)Eaffected
15.2(8)E1affected
15.2(7)E5affected
15.2(7)E6affected
15.2(8)E2affected
15.2(7)E7affected
15.2(8)E3affected
15.2(7)E8affected
15.2(8)E4affected
15.2(7)E9affected
15.2(8)E5affected
15.2(7)E10affected
15.2(6)EBaffected

Cisco Cisco IOS XE Software

3.2.0SGaffected
3.2.1SGaffected
3.2.2SGaffected
3.2.3SGaffected
3.2.4SGaffected
3.2.5SGaffected
3.2.6SGaffected
3.2.7SGaffected
3.2.8SGaffected
3.2.9SGaffected
3.2.10SGaffected
3.2.11SGaffected
3.7.0Saffected
3.7.1Saffected
3.7.2Saffected
3.7.3Saffected
3.7.4Saffected
3.7.5Saffected
3.7.6Saffected
3.7.7Saffected
3.7.4aSaffected
3.7.2tSaffected
3.7.0bSaffected
3.7.1aSaffected
3.3.0SGaffected
3.3.2SGaffected
3.3.1SGaffected
3.8.0Saffected
3.8.1Saffected
3.8.2Saffected
3.9.1Saffected
3.9.0Saffected
3.9.2Saffected
3.9.1aSaffected
3.9.0aSaffected
3.2.0SEaffected
3.2.1SEaffected
3.2.2SEaffected
3.2.3SEaffected
3.3.0SEaffected
3.3.1SEaffected
3.3.2SEaffected
3.3.3SEaffected
3.3.4SEaffected
3.3.5SEaffected
3.4.0SGaffected
3.4.2SGaffected
3.4.1SGaffected
3.4.3SGaffected
3.4.4SGaffected
3.4.5SGaffected
3.4.6SGaffected
3.4.7SGaffected
3.4.8SGaffected
3.5.0Eaffected
3.5.1Eaffected
3.5.2Eaffected
3.5.3Eaffected
3.10.0Saffected
3.10.1Saffected
3.10.2Saffected
3.10.3Saffected
3.10.4Saffected
3.10.5Saffected
3.10.6Saffected
3.10.2tSaffected
3.10.7Saffected
3.10.1xbSaffected
3.10.8Saffected
3.10.8aSaffected
3.10.9Saffected
3.10.10Saffected
3.11.1Saffected
3.11.2Saffected
3.11.0Saffected
3.11.3Saffected
3.11.4Saffected
3.12.0Saffected
3.12.1Saffected
3.12.2Saffected
3.12.3Saffected
3.12.0aSaffected
3.12.4Saffected
3.13.0Saffected
3.13.1Saffected
3.13.2Saffected
3.13.3Saffected
3.13.4Saffected
3.13.5Saffected
3.13.2aSaffected
3.13.0aSaffected
3.13.5aSaffected
3.13.6Saffected
3.13.7Saffected
3.13.6aSaffected
3.13.7aSaffected
3.13.8Saffected
3.13.9Saffected
3.13.10Saffected
3.6.0Eaffected
3.6.1Eaffected
3.6.2aEaffected
3.6.2Eaffected
3.6.3Eaffected
3.6.4Eaffected
3.6.5Eaffected
3.6.6Eaffected
3.6.5aEaffected
3.6.5bEaffected
3.6.7Eaffected
3.6.8Eaffected
3.6.7bEaffected
3.6.9Eaffected
3.6.10Eaffected
3.14.0Saffected
3.14.1Saffected
3.14.2Saffected
3.14.3Saffected
3.14.4Saffected
3.15.0Saffected
3.15.1Saffected
3.15.2Saffected
3.15.1cSaffected
3.15.3Saffected
3.15.4Saffected
3.3.0SQaffected
3.3.1SQaffected
3.4.0SQaffected
3.4.1SQaffected
3.7.0Eaffected
3.7.1Eaffected
3.7.2Eaffected
3.7.3Eaffected
3.7.4Eaffected
3.7.5Eaffected
3.5.0SQaffected
3.5.1SQaffected
3.5.2SQaffected
3.5.3SQaffected
3.5.4SQaffected
3.5.5SQaffected
3.5.6SQaffected
3.5.7SQaffected
3.5.8SQaffected
3.16.0Saffected
3.16.1Saffected
3.16.1aSaffected
3.16.2Saffected
3.16.2aSaffected
3.16.0cSaffected
3.16.3Saffected
3.16.2bSaffected
3.16.3aSaffected
3.16.4Saffected
3.16.4aSaffected
3.16.4bSaffected
3.16.5Saffected
3.16.4dSaffected
3.16.6Saffected
3.16.7Saffected
3.16.6bSaffected
3.16.7aSaffected
3.16.7bSaffected
3.16.8Saffected
3.16.9Saffected
3.16.10Saffected
3.17.0Saffected
3.17.1Saffected
3.17.2Saffected
3.17.1aSaffected
3.17.3Saffected
3.17.4Saffected
16.1.1affected
16.1.2affected
16.1.3affected
16.2.1affected
16.2.2affected
3.8.0Eaffected
3.8.1Eaffected
3.8.2Eaffected
3.8.3Eaffected
3.8.4Eaffected
3.8.5Eaffected
3.8.5aEaffected
3.8.6Eaffected
3.8.7Eaffected
3.8.8Eaffected
3.8.9Eaffected
3.8.10Eaffected
3.8.10eEaffected
16.3.1affected
16.3.2affected
16.3.3affected
16.3.1aaffected
16.3.4affected
16.3.5affected
16.3.5baffected
16.3.6affected
16.3.7affected
16.3.8affected
16.3.9affected
16.3.10affected
16.3.11affected
16.4.1affected
16.4.2affected
16.4.3affected
16.5.1affected
16.5.1aaffected
16.5.1baffected
16.5.2affected
16.5.3affected
3.18.0aSaffected
3.18.0Saffected
3.18.1Saffected
3.18.2Saffected
3.18.3Saffected
3.18.4Saffected
3.18.0SPaffected
3.18.1SPaffected
3.18.1aSPaffected
3.18.1bSPaffected
3.18.1cSPaffected
3.18.2SPaffected
3.18.2aSPaffected
3.18.3SPaffected
3.18.4SPaffected
3.18.3aSPaffected
3.18.3bSPaffected
3.18.5SPaffected
3.18.6SPaffected
3.18.7SPaffected
3.18.8aSPaffected
3.18.9SPaffected
3.9.0Eaffected
3.9.1Eaffected
3.9.2Eaffected
16.6.1affected
16.6.2affected
16.6.3affected
16.6.4affected
16.6.5affected
16.6.4aaffected
16.6.5aaffected
16.6.6affected
16.6.7affected
16.6.8affected
16.6.9affected
16.6.10affected
16.7.1affected
16.7.1aaffected
16.7.1baffected
16.7.2affected
16.7.3affected
16.7.4affected
16.8.1affected
16.8.1aaffected
16.8.1baffected
16.8.1saffected
16.8.1caffected
16.8.1daffected
16.8.2affected
16.8.1eaffected
16.8.3affected
16.9.1affected
16.9.2affected
16.9.1aaffected
16.9.1baffected
16.9.1saffected
16.9.3affected
16.9.4affected
16.9.3aaffected
16.9.5affected
16.9.5faffected
16.9.6affected
16.9.7affected
16.9.8affected
16.10.1affected
16.10.1aaffected
16.10.1baffected
16.10.1saffected
16.10.1caffected
16.10.1eaffected
16.10.1daffected
16.10.2affected
16.10.1faffected
16.10.1gaffected
16.10.3affected
3.10.0Eaffected
3.10.1Eaffected
3.10.0cEaffected
3.10.2Eaffected
3.10.3Eaffected
16.11.1affected
16.11.1aaffected
16.11.1baffected
16.11.2affected
16.11.1saffected
16.12.1affected
16.12.1saffected
16.12.1aaffected
16.12.1caffected
16.12.1waffected
16.12.2affected
16.12.1yaffected
16.12.2aaffected
16.12.3affected
16.12.8affected
16.12.2saffected
16.12.1xaffected
16.12.1taffected
16.12.4affected
16.12.3saffected
16.12.3aaffected
16.12.4aaffected
16.12.5affected
16.12.6affected
16.12.1z1affected
16.12.5aaffected
16.12.5baffected
16.12.1z2affected
16.12.6aaffected
16.12.7affected
16.12.9affected
16.12.10affected
16.12.10aaffected
16.12.11affected
3.11.0Eaffected
3.11.1Eaffected
3.11.2Eaffected
3.11.3Eaffected
3.11.1aEaffected
3.11.4Eaffected
3.11.3aEaffected
3.11.5Eaffected
3.11.6Eaffected
3.11.7Eaffected
3.11.8Eaffected
3.11.9Eaffected
3.11.10Eaffected
17.1.1affected
17.1.1aaffected
17.1.1saffected
17.1.1taffected
17.1.3affected
17.2.1affected
17.2.1raffected
17.2.1aaffected
17.2.1vaffected
17.2.2affected
17.2.3affected
17.3.1affected
17.3.2affected
17.3.3affected
17.3.1aaffected
17.3.1waffected
17.3.2aaffected
17.3.1xaffected
17.3.1zaffected
17.3.4affected
17.3.5affected
17.3.4aaffected
17.3.6affected
17.3.4baffected
17.3.4caffected
17.3.5aaffected
17.3.5baffected
17.3.7affected
17.3.8affected
17.3.8aaffected
17.4.1affected
17.4.2affected
17.4.1aaffected
17.4.1baffected
17.4.2aaffected
17.5.1affected
17.5.1aaffected
17.6.1affected
17.6.2affected
17.6.1waffected
17.6.1aaffected
17.6.1xaffected
17.6.3affected
17.6.1yaffected
17.6.1zaffected
17.6.3aaffected
17.6.4affected
17.6.1z1affected
17.6.5affected
17.6.6affected
17.6.6aaffected
17.6.5aaffected
17.6.7affected
17.7.1affected
17.7.1aaffected
17.7.1baffected
17.7.2affected
17.10.1affected
17.10.1aaffected
17.10.1baffected
17.8.1affected
17.8.1aaffected
17.9.1affected
17.9.1waffected
17.9.2affected
17.9.1aaffected
17.9.1xaffected
17.9.1yaffected
17.9.3affected
17.9.2aaffected
17.9.1x1affected
17.9.3aaffected
17.9.4affected
17.9.1y1affected
17.9.5affected
17.9.4aaffected
17.9.5aaffected
17.9.5baffected
17.11.1affected
17.11.1aaffected
17.12.1affected
17.12.1waffected
17.12.1aaffected
17.12.1xaffected
17.12.2affected
17.12.3affected
17.12.2aaffected
17.12.1yaffected
17.12.3aaffected
17.13.1affected
17.13.1aaffected
17.11.99SWaffected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-webui-HfwnRgk ↗