Cisco Expressway flaw lets remote attackers read sensitive data
Original title: Cisco Expressway Series Information Disclosure Vulnerability
A crafted HTTP request during Mobile and Remote Access provisioning can bypass authorization checks on Expressway-C and Expressway-E.
Cisco reports an information-disclosure flaw in Cisco Expressway Series, covering Expressway Core (Expressway-C) and Expressway Edge (Expressway-E). Insufficient authorization checks on HTTP requests during Mobile and Remote Access provisioning let an unauthenticated remote attacker submit a crafted URL and obtain sensitive information they are not authorized to access. Cisco has released software updates. The snippet does not give versions or a CVE.
Unconfirmed: Affected and fixed versions and any CVE are not in the snippet.
- The issue is insufficient authorization checks of HTTP requests.
- Exploitation uses a crafted URL request to an affected device.
- Both Expressway-C and Expressway-E devices are in scope.
- Cisco says it has released software updates.
Impact: Unauthorized access to sensitive device information
| Product | Affected |
|---|---|
| Cisco Expressway Series (Expressway-C and Expressway-E) | — |
- 1.Install the Cisco Expressway software updates Cisco has released.
- Vendors
- Cisco
From the original article
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.