Cisco Unified Contact Center Enterprise - SSRF (CVE-2024-20404)
Description
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system.
This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.
psychologyCrowdSec Analysis
CVE-2024-20404 is a vulnerability in the web-based management interface of Cisco Finesse and related contact center products that allows unauthenticated, remote attackers to perform server-side request forgery (SSRF) attacks. By exploiting insufficient input validation, attackers can send crafted HTTP requests to the affected system, potentially gaining access to limited sensitive information from associated services. This flaw could be leveraged to further probe internal network resources or exfiltrate data, posing a significant risk to organizations using these Cisco solutions.
CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-20404 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending crafted POST requests to the /gadgets/metadata endpoint, embedding external URLs in the JSON body to trigger server-side requests and potentially access sensitive internal resources.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-06-05 |
| Rule Released | 2025-12-10 |