CVE-2024-20404

HIGHNuclei

Cisco finesse Server-Side Request Forgery (SSRF)

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-20404 has a selected CVSS score of 7.2 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 4, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 5, 2024 · Source: CVE List

Affected products and versions

5
ProductSourceVersion range

Cisco Finesse

Browse Cisco / Cisco Finesse
CVE List12.6(2)affected
12.6(2)ES1affected
12.6(2)ES2affected

Cisco Packaged Contact Center Enterprise

Browse Cisco / Cisco Packaged Contact Center Enterprise
CVE ListVersion range not suppliedaffected

Cisco Unified Contact Center Enterprise

Browse Cisco / Cisco Unified Contact Center Enterprise
CVE ListVersion range not suppliedaffected

Cisco Unified Contact Center Express

Browse Cisco / Cisco Unified Contact Center Express
CVE ListVersion range not suppliedaffected

finesse

Browse Cisco / finesse
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHub3zz4t/CVE-2024-20404Repository PoCby 3zz4t2Not analyzed4 files

792.9 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMCisco Finesse - Server-Side Request Forgery (SSRF)CVSS 5.8

Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests.

Impact

Attackers can access sensitive information from services associated with the device, potentially leading to information disclosure.

Remediation

Apply the latest security patches and updates provided by Cisco for Finesse.

WeaknessesCWE-918
Authors0x_Akoko
Template tagscvecve2024ciscofinessessrfunauthoobvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Shodan: title:"Cisco Finesse" port:8445
FOFA: title="Cisco Finesse" && port="8445"
https://github.com/3zz4t/CVE-2024-20404 https://nvd.nist.gov/vuln/detail/CVE-2024-20404

Source: ProjectDiscovery

References

2