CVE-2020-3261
Description
A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user with an active session on an affected device to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, including modifying the configuration, with the privilege level of the user.
How to fix
- cisco aironet_1542i_firmware8.8.130.0 or later
- cisco aironet_1542d_firmware8.8.130.0 or later
- cisco aironet_1562i_firmware8.8.130.0 or later
- cisco aironet_1562e_firmware8.8.130.0 or later
- cisco aironet_1562d_firmware8.8.130.0 or later
- cisco aironet_1815_firmware8.8.130.0 or later
- cisco aironet_1830_firmware8.8.130.0 or later
- cisco aironet_1840_firmware8.8.130.0 or later
- cisco aironet_1850_firmware8.8.130.0 or later
- cisco aironet_2800i_firmware8.8.130.0 or later
- cisco aironet_2800e_firmware8.8.130.0 or later
- cisco aironet_3800i_firmware8.8.130.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco aironet_1542i_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1542d_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1562i_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1562e_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1562d_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1815_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1830_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1840_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_1850_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_2800i_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_2800e_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_3800i_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_3800e_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_3800p_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco aironet_4800_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco catalyst_iw6300_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
| cisco 6300_series_access_points_firmware | 8.0 ≤ v < 8.8.130.0, 8.10\(1.255\) | 8.8.130.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.