Path traversal in Cisco Emergency Responder
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An attacker could exploit this vulnerability by sending crafted requests to the web UI. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user, such as accessing password or log files or uploading and deleting existing files from the system.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Emergency Responder | 10.5(1a); 10.5(1); 11.5(4)SU2; 11.5(4)SU4; 11.5(4)SU3; 11.5(1); 11.5(3); 11.5(2); 11.5(4a); 11.5(4); 11.5(2a); 11.5(4)SU10; 11.5(4)SU9; 11.5(4)SU11; 12.5(1); 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU1; 12.5(1a); 12.5(1)SU4; 12.5(1)SU5; 12.5(1)SU6; 12.5(1)SU7; 12.5(1)SU8; 12.5(1)SU8a; 12.5(1)SU8b; 12.0(1) SU2; 12.0(1) SU1; 12.0(1); 10.0.2; 10.0(1); 11.0(1); 14SU1; 14SU2; 14 | — | No fix listed | CNA |
- Cisco Emergency Responder VendorCisco Affected 10.5(1a); 10.5(1); 11.5(4)SU2; 11.5(4)SU4; 11.5(4)SU3; 11.5(1); 11.5(3); 11.5(2); 11.5(4a); 11.5(4); 11.5(2a); 11.5(4)SU10; 11.5(4)SU9; 11.5(4)SU11; 12.5(1); 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU1; 12.5(1a); 12.5(1)SU4; 12.5(1)SU5; 12.5(1)SU6; 12.5(1)SU7; 12.5(1)SU8; 12.5(1)SU8a; 12.5(1)SU8b; 12.0(1) SU2; 12.0(1) SU1; 12.0(1); 10.0.2; 10.0(1); 11.0(1); 14SU1; 14SU2; 14 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:emergency_responder:*:*:*:*:*:*:*:* | before 12.5(1)su8b | Vulnerable | Cisco |
| cpe:2.3:a:cisco:emergency_responder:14:*:*:*:*:*:*:* | 14 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:emergency_responder:14su1:*:*:*:*:*:*:* | 14su1 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:emergency_responder:14su2:*:*:*:*:*:*:* | 14su2 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:emergency_responder:14su3:*:*:*:*:*:*:* | 14su3 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:emergency_responder:14su3a:*:*:*:*:*:*:* | 14su3a | Vulnerable | Cisco |
- cpe:2.3:a:cisco:emergency_responder:*:*:*:*:*:*:*:* Versions before 12.5(1)su8b Vulnerable ·Cisco
- cpe:2.3:a:cisco:emergency_responder:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Cisco
- cpe:2.3:a:cisco:emergency_responder:14su1:*:*:*:*:*:*:* Versions 14su1 Vulnerable ·Cisco
- cpe:2.3:a:cisco:emergency_responder:14su2:*:*:*:*:*:*:* Versions 14su2 Vulnerable ·Cisco
- cpe:2.3:a:cisco:emergency_responder:14su3:*:*:*:*:*:*:* Versions 14su3 Vulnerable ·Cisco
- cpe:2.3:a:cisco:emergency_responder:14su3a:*:*:*:*:*:*:* Versions 14su3a Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-20352
- 2026-10-03 Alias added: GHSA-4pgp-hx9q-53rp
References
Advisory 1
More Cisco Emergency Responder vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2005-00319 Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with… CVSS 2.0MEDIUM 5.0
- TI-2023-06808 Hard-coded credentials in Cisco Emergency Responder CVSS 3.1CRITICAL 9.8
- TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
- TI-2008-01106 The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications… CVSS 2.0HIGH 10.0
- TI-2004-01636 The default installation of Cisco voice products, when running the IBM Director Agent on… CVSS 2.0HIGH 10.0
Sources
- CVE-2024-20352 · CVE Program
- CVE-2024-20352 · NVD
- FIRST EPSS
- GHSA-4pgp-hx9q-53rp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences