High severity · published Nov 15, 2024
CVE-2022-20853
Cisco Expressway Series and Cisco TelePresence VCS Cross-Site Request Forgery Vulnerability
7.4
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Cisco TelePresence Video Communication Server (VCS) Expressway · Cisco
X8.11.2; X8.6; X8.11.3; X8.2.2; X8.8.3; X8.11.0; +34 more · source: vendor
TV
Telepresence Video Communication Server · Cisco
x8.1; x8.1.1; x8.1.2; x8.2; x8.2.1; x8.2.2; +34 more · source: NVD
TV
Telepresence Video Communication Server Software · Cisco
x12.5.0; x12.5.1; x12.5.2; x12.5.3; x12.5.4; x12.5.5; +34 more · source: CISA
Affected product
CT
Cisco TelePresence Video Communication Server (VCS) Expressway
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-20853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-20853
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8
More from Cisco TelePresence Video Communication Server (VCS) Expressway
9.8
CVE-2026-76466
Cisco Expressway Series Remote Code Execution Vulnerability
8.8
CVE-2024-20254
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site…
8.8
CVE-2024-20252
Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site…
8.6
CVE-2026-76490
Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
7.8
CVE-2026-76495
Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities