Cisco Expressway Edge Improper Authorization Vulnerability (CVE-2024-20497)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Cisco Expressway Edge Improper Authorization Vulnerability - Vulnerability ID: cisco-sa-expressway-auth-kdFrcZ2j - CVE Number: CVE-2024-20497 - CWE Number: CWE-285 - Severity: Medium 2. Affected Products: - Affected Product: Cisco Expressway Edge (Expressway-E) - Affected Versions: Version 14 and earlier - Affected Hardware Versions: All hardware versions - Affected Software Versions: All software versions 3. Vulnerability Impact: - Description: Allows an unauthenticated remote attacker to impersonate another user, thereby intercepting calls or phone numbers. - Exploitation: Exploited by executing a series of carefully crafted commands. - Mitigation: No mitigations are available. 4. Affected Software Versions: - Affected Software Versions: All versions 5. Fix Status: - Fix Status: At the time of release, affected software versions were 14 and earlier. - Recommended Fix: Upgrade to version 15.2. 6. Vulnerability Discovery: - Discoverer: Jason Crowder, Cisco Advanced Security Initiatives Group (ASIG) 7. Legal Disclaimer: - Disclaimer: This document is provided "AS IS" without any warranty or guarantee, including but not limited to implied warranties of merchantability or fitness for a particular purpose. The user assumes all risks associated with the use of information in this document or linked materials. Cisco reserves the right to modify or update this document at any time. This information helps users understand the severity of the vulnerability, the affected products and software versions, exploitation methods, mitigation options, remediation steps, and the vulnerability discoverer.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Expressway Edge Improper Authorization Vulnerability (CVE-2024-20497)