CVE-2024-20404

HIGH EXPLOITED NUCLEI

Cisco Finesse - SSRF

Title source: llm

Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.

Exploits (2)

nomisec WORKING POC 2 stars

by 3zz4t · poc

https://github.com/3zz4t/CVE-2024-20404

View Code ZIP pw:eip

vulncheck_xdb WORKING POC

client-side

https://github.com/AbdElRahmanEzzat1995/CVE-2024-20404

View Code ZIP pw:eip

Nuclei Templates (1)

Cisco Finesse - Server-Side Request Forgery (SSRF)

MEDIUMVERIFIEDby 0x_Akoko

Shodan: title:"Cisco Finesse" port:8445

FOFA: title="Cisco Finesse" && port="8445"

References (1)

[Vendor Advisory] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-rfi-Um7wT8Ew

Scores

CVSS v3 7.2

EPSS 0.7913

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Details

VulnCheck KEV 2026-02-04

CWE

CWE-918

Status published

Products (3)

cisco/finesse 11.6\(1\) (6 CPE variants)

cisco/finesse 12.6\(2\) (3 CPE variants)

cisco/finesse < 11.6\(1\)

Published Jun 05, 2024

Tracked Since Feb 18, 2026