© 2026 vulntracker.io

CVE-2024-20252

HIGH

8.8

CVSS Score

Published: February 7, 2024 at 04:15 PM UTC

Updated: June 17, 2026 at 07:06 AM UTC

2 products affected across 1 vendorTelepresence Video Communication ServerExpressway

Using Cisco TelePresence Video Communication Server (VCS) Expressway by Cisco?

Get instant alerts when new vulnerabilities affect Cisco TelePresence Video Communication Server (VCS) Expressway - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device. Note: "Cisco Expressway Series" refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Expressway · Cisco

95%

v ≤ 15.0

Telepresence Video Communication Server · Cisco

95%

X12.5.0X12.5.1X12.5.2X12.5.3X12.5.4X12.5.5X12.5.6X12.5.7X12.5.8X12.5.9X12.6.0X12.6.1X12.6.2X12.6.3X12.6.4X12.7.0X12.7.1X14.0.1X14.0.10 X14.0.11X14.0.2X14.0.3X14.0.4X14.0.5X14.0.6X14.0.7X14.0.8X14.0.9X14.2.0 X14.2.1 X14.2.2 X14.2.5 X14.2.6 X14.2.7 X14.3.0X14.3.1X14.3.2X8.1X8.1.1X8.1.2X8.10.0X8.10.1X8.10.2X8.10.3X8.10.4X8.11.0X8.11.1X8.11.2X8.11.3X8.11.4X8.2X8.2.1X8.2.2X8.5X8.5.1X8.5.3X8.6X8.6.1X8.7X8.7.1X8.7.2X8.7.3X8.8X8.8.1X8.8.2X8.8.3X8.9X8.9.1X8.9.2x12.5.0 x12.5.1 x12.5.2 x12.5.3 x12.5.4 x12.5.5 x12.5.6 x12.5.7 x12.5.8 x12.5.9 x12.6.0 x12.6.1 x12.6.2 x12.6.3 x12.6.4 x12.7.0 x12.7.1 x14.0.1x14.0.10x14.0.11x14.0.2 x14.0.3 x14.0.4 x14.0.5 x14.0.6 x14.0.7 x14.0.8 x14.0.9x14.2.0x14.2.1x14.2.2x14.2.5x14.2.6x14.2.7x14.3.0x14.3.1 x14.3.2 x8.1 x8.1.1 x8.1.2 x8.10.0 x8.10.1 x8.10.2 x8.10.3 x8.10.4 x8.11.0 x8.11.1 x8.11.2 x8.11.3 x8.11.4 x8.2 x8.2.1 x8.2.2 x8.5 x8.5.1 x8.5.3 x8.6 x8.6.1 x8.7 x8.7.1 x8.7.2 x8.7.3 x8.8 x8.8.1 x8.8.2 x8.8.3 x8.9 x8.9.1 x8.9.2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card