CVE-2020-3261
A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-sit…
Impact
A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user with an active session on an affected device to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, including modifying the configuration, with the privilege level of the user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Aironet 1542i Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1542d Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1562i Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1562e Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1562d Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1815 Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1830 Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1840 Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 1850 Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 2800i Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 2800e Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |
| Cisco | Aironet 3800i Firmware | from 8.0 before 8.8.130.0 Version 8.10\(1.255\) |