Server-side request forgery in Cisco Unified Contact Center Enterprise
Priority MEDIUM 52CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.22644 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Unified Contact Center Enterprise | N/A | — | No fix listed | CNA |
| Cisco | Cisco Unified Contact Center Express | N/A | — | No fix listed | CNA |
| Cisco | Cisco Finesse | 12.6(2); 12.6(2)ES1; 12.6(2)ES2 | — | No fix listed | CNA |
| Cisco | Cisco Packaged Contact Center Enterprise | N/A | — | No fix listed | CNA |
- Cisco Unified Contact Center Enterprise VendorCisco Affected N/A Fixed in — No fix listed CNA
- Cisco Unified Contact Center Express VendorCisco Affected N/A Fixed in — No fix listed CNA
- Cisco Finesse VendorCisco Affected 12.6(2); 12.6(2)ES1; 12.6(2)ES2 Fixed in — No fix listed CNA
- Cisco Packaged Contact Center Enterprise VendorCisco Affected N/A Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:* | before 11.6\(1\) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:11.6\(1\):-:*:*:*:*:*:* | 11.6(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:11.6\(1\):es4:*:*:*:*:*:* | 11.6(1) es4 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:11.6\(1\):es5:*:*:*:*:*:* | 11.6(1) es5 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:11.6\(1\):es6:*:*:*:*:*:* | 11.6(1) es6 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:11.6\(1\):es7:*:*:*:*:*:* | 11.6(1) es7 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:11.6\(1\):es8:*:*:*:*:*:* | 11.6(1) es8 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:12.6\(2\):-:*:*:*:*:*:* | 12.6(2) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:12.6\(2\):es01:*:*:*:*:*:* | 12.6(2) es01 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:finesse:12.6\(2\):es02:*:*:*:*:*:* | 12.6(2) es02 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:* Versions before 11.6\(1\) Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:11.6\(1\):-:*:*:*:*:*:* Versions 11.6(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:11.6\(1\):es4:*:*:*:*:*:* Versions 11.6(1) es4 Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:11.6\(1\):es5:*:*:*:*:*:* Versions 11.6(1) es5 Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:11.6\(1\):es6:*:*:*:*:*:* Versions 11.6(1) es6 Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:11.6\(1\):es7:*:*:*:*:*:* Versions 11.6(1) es7 Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:11.6\(1\):es8:*:*:*:*:*:* Versions 11.6(1) es8 Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:12.6\(2\):-:*:*:*:*:*:* Versions 12.6(2) Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:12.6\(2\):es01:*:*:*:*:*:* Versions 12.6(2) es01 Vulnerable ·Cisco
- cpe:2.3:a:cisco:finesse:12.6\(2\):es02:*:*:*:*:*:* Versions 12.6(2) es02 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-20404
- 2026-10-03 Alias added: GHSA-vhv4-j9cm-5cjx
References
Advisory 1
More Cisco Finesse vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2018-00358 Access control flaw in Cisco Finesse unknown CVSS 3.0CRITICAL 9.8
- TI-2018-00357 Access control flaw in Cisco Finesse unknown CVSS 3.0CRITICAL 9.8
- TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
- TI-2017-04533 Resource management flaw in Multiple Cisco Products unknown CVSS 3.0HIGH 7.5
- TI-2019-09432 Cisco Finesse Request Processing Server-Side Request Forgery Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2024-20404 · CVE Program
- CVE-2024-20404 · NVD
- FIRST EPSS
- GHSA-vhv4-j9cm-5cjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences