© 2026 vulntracker.io

CVE-2024-20400

MEDIUM

4.7

CVSS Score

Published: July 17, 2024 at 04:29 PM UTC

Updated: June 17, 2026 at 07:06 AM UTC

1 product affected across 1 vendorTelepresence Video Communication Server

Using Cisco TelePresence Video Communication Server (VCS) Expressway by Cisco?

Get instant alerts when new vulnerabilities affect Cisco TelePresence Video Communication Server (VCS) Expressway - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.7

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page. Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Telepresence Video Communication Server · Cisco

95%

X12.5.0X12.5.1X12.5.2X12.5.3X12.5.4X12.5.5X12.5.6X12.5.7X12.5.8X12.5.9X12.6.0X12.6.1X12.6.2X12.6.3X12.6.4X12.7.0X12.7.1X14.0.1X14.0.10 X14.0.11X14.0.2X14.0.3X14.0.4X14.0.5X14.0.6X14.0.7X14.0.8X14.0.9X14.2.0 X14.2.1 X14.2.2 X14.2.5 X14.2.6 X14.2.7 X14.3.0X14.3.1X14.3.2X14.3.3X14.3.4X14.3.5X15.0.0X15.0.1X8.1X8.1.1X8.1.2X8.10.0X8.10.1X8.10.2X8.10.3X8.10.4X8.11.0X8.11.1X8.11.2X8.11.3X8.11.4X8.2X8.2.1X8.2.2X8.5X8.5.1X8.5.3X8.6X8.6.1X8.7X8.7.1X8.7.2X8.7.3X8.8X8.8.1X8.8.2X8.8.3X8.9X8.9.1X8.9.2x12.5.0 x12.5.1 x12.5.2 x12.5.3 x12.5.4 x12.5.5 x12.5.6 x12.5.7 x12.5.8 x12.5.9 x12.6.0 x12.6.1 x12.6.2 x12.6.3 x12.6.4 x12.7.0 x12.7.1 x14.0.1x14.0.10x14.0.11x14.0.2 x14.0.3 x14.0.4 x14.0.5 x14.0.6 x14.0.7 x14.0.8 x14.0.9x14.2.0x14.2.1x14.2.2x14.2.5x14.2.6x14.2.7x14.3.0x14.3.1 x14.3.2 x14.3.3 x14.3.4 x14.3.5 x15.0.0 x15.0.1 x8.1 x8.1.1 x8.1.2 x8.10.0 x8.10.1 x8.10.2 x8.10.3 x8.10.4 x8.11.0 x8.11.1 x8.11.2 x8.11.3 x8.11.4 x8.2 x8.2.1 x8.2.2 x8.5 x8.5.1 x8.5.3 x8.6 x8.6.1 x8.7 x8.7.1 x8.7.2 x8.7.3 x8.8 x8.8.1 x8.8.2 x8.8.3 x8.9 x8.9.1 x8.9.2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-redirect-KJsFuXgj

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-redirect-KJsFuXgj

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.7MEDIUMcisco

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: NONE
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-601

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card