Information Disclosure in Cisco Expressway Series

Executive Summary

This is an information disclosure vulnerability in Cisco Expressway Series devices, including both Expressway-Core and Expressway-Edge. It occurs due to insufficient authorization checks during Mobile and Remote Access provisioning via HTTP requests. An unauthenticated remote attacker could exploit this by sending a crafted URL request to access sensitive information they are not authorized to view.

Useful 0 Not Useful 0

Detection Guidance

Monitor HTTP traffic to Cisco Expressway Series devices for unusual URL requests or unauthorized access attempts. Check logs for suspicious activity related to MRA provisioning. Use network scanning tools to identify vulnerable versions of Cisco Expressway-C or Expressway-E.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive information on affected Cisco Expressway devices. This may include confidential data processed or stored by the device, potentially leading to data breaches, privacy violations, or further exploitation of the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under regulations like GDPR or HIPAA. Organizations using affected Cisco Expressway devices may face legal penalties, reputational damage, and increased scrutiny for failing to protect personal or health information adequately.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade affected Cisco Expressway Series devices to fixed software releases like X15.5.3 or later. Disable unnecessary HTTP services if not required. Apply network-level controls to restrict access to Expressway devices from untrusted sources.

Useful 0 Not Useful 0