A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system.
This vulnerability is due to inadequate authorization checks for Mobile and Remote Access (MRA) users. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to intercept calls that are destined for a particular phone number or to make phone calls and have that phone number appear on the caller ID. To successfully exploit this vulnerability, the attacker must be an MRA user on an affected system.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Wed, 04 Sep 2024 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 04 Sep 2024 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in Cisco Expressway Edge (Expressway-E) could allow an authenticated, remote attacker to masquerade as another user on an affected system. This vulnerability is due to inadequate authorization checks for Mobile and Remote Access (MRA) users. An attacker could exploit this vulnerability by running a series of crafted commands. A successful exploit could allow the attacker to intercept calls that are destined for a particular phone number or to make phone calls and have that phone number appear on the caller ID. To successfully exploit this vulnerability, the attacker must be an MRA user on an affected system. | |
| Title | Cisco Expressway Edge Improper Authorization Vulnerability | |
| Weaknesses | CWE-285 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2024-09-04T16:29:13.595Z
Updated: 2024-09-04T17:33:38.771Z
Reserved: 2023-11-08T15:08:07.686Z
Link: CVE-2024-20497
Vulnrichment
Updated: 2024-09-04T17:33:35.632Z
NVD
Status : Awaiting Analysis
Published: 2024-09-04T17:15:13.970
Modified: 2024-09-05T12:53:21.110
Link: CVE-2024-20497
Redhat
No data.