Skip to content
fr Sign in
6.5 Medium

CVE-2024-20414 A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated,…

Description

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.

Affected products and versions

Product Affected versions Fixed in
IOS Versions not published
Cisco IOS XE Software 17.13 17.13.1a → 17.13.1 No fix stated
Cisco IOS XE Software 17.12 17.12.1w → 17.12.3 No fix stated
Cisco IOS XE Software 17.11 17.11.1a → 17.11.99SW No fix stated
Cisco IOS XE Software 17.10 17.10.1a → 17.10.1 No fix stated
Cisco IOS XE Software 17.9 17.9.1w → 17.9.5 No fix stated
Cisco IOS XE Software 17.8 17.8.1a → 17.8.1 No fix stated
Cisco IOS XE Software 17.7 17.7.1a → 17.7.2 No fix stated
Cisco IOS XE Software 17.6 17.6.1w → 17.6.7 No fix stated
Show the 34 other branches
Product Affected versions Fixed in
Cisco IOS XE Software 17.5 17.5.1a → 17.5.1 No fix stated
Cisco IOS XE Software 17.4 17.4.1a → 17.4.2 No fix stated
Cisco IOS XE Software 17.3 17.3.1w → 17.3.8 No fix stated
Cisco IOS XE Software 17.2 17.2.1r → 17.2.3 No fix stated
Cisco IOS XE Software 17.1 17.1.1s → 17.1.3 No fix stated
Cisco IOS XE Software 16.12 16.12.1s → 16.12.11 No fix stated
Cisco IOS XE Software 16.11 16.11.1s → 16.11.2 No fix stated
Cisco IOS XE Software 16.10 16.10.1s → 16.10.3 No fix stated
Cisco IOS XE Software 16.9 16.9.1s → 16.9.8 No fix stated
Cisco IOS XE Software 16.8 16.8.1s → 16.8.3 No fix stated
Cisco IOS XE Software 16.7 16.7.1a → 16.7.4 No fix stated
Cisco IOS XE Software 16.6 16.6.1 → 16.6.10 No fix stated
Cisco IOS XE Software 16.5 16.5.1a → 16.5.3 No fix stated
Cisco IOS XE Software 16.4 16.4.1 → 16.4.3 No fix stated
Cisco IOS XE Software 16.3 16.3.1a → 16.3.11 No fix stated
Cisco IOS XE Software 16.2 16.2.1 → 16.2.2 No fix stated
Cisco IOS XE Software 16.1 16.1.1 → 16.1.3 No fix stated
Cisco IOS XE Software 3.18 3.18.0S → 3.18.9SP No fix stated
Cisco IOS XE Software 3.17 3.17.0S → 3.17.4S No fix stated
Cisco IOS XE Software 3.16 3.16.0S → 3.16.10S No fix stated
Cisco IOS XE Software 3.15 3.15.0S → 3.15.4S No fix stated
Cisco IOS XE Software 3.14 3.14.0S → 3.14.4S No fix stated
Cisco IOS XE Software 3.13 3.13.0S → 3.13.10S No fix stated
Cisco IOS XE Software 3.12 3.12.0S → 3.12.4S No fix stated
Cisco IOS XE Software 3.11 3.11.0S → 3.11.10E No fix stated
Cisco IOS XE Software 3.10 3.10.0S → 3.10.10S No fix stated
Cisco IOS XE Software 3.9 3.9.0S → 3.9.2S No fix stated
Cisco IOS XE Software 3.8 3.8.0S → 3.8.10E No fix stated
Cisco IOS XE Software 3.7 3.7.0S → 3.7.7S No fix stated
Cisco IOS XE Software 3.6 3.6.0E → 3.6.10E No fix stated
Cisco IOS XE Software 3.5 3.5.0E → 3.5.8SQ No fix stated
Cisco IOS XE Software 3.4 3.4.0SG → 3.4.8SG No fix stated
Cisco IOS XE Software 3.3 3.3.0SG → 3.3.5SE No fix stated
Cisco IOS XE Software 3.2 3.2.0SG → 3.2.11SG No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of IOS

The 39 CVEs of IOS →
CVE-2026-20301 A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of… 8.6 High CVE-2026-20125 A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an… 7.7 High CVE-2026-20012 A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software,… 8.6 High CVE-2025-20363 A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure… 9.0 Critical
Track this CVE