# CVE-2024-20404: Cisco Unified Contact Center Enterprise - SSRF

> Live exploitation tracking for CVE-2024-20404 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-20404

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.2
- **Public exploit available:** Yes
- **Affected products:** Cisco Unified Contact Center Enterprise, Cisco Unified Contact Center Express, Cisco Finesse, Cisco Packaged Contact Center Enterprise
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** enterprise_software

## Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system.

 This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.

## CrowdSec analysis

[CVE-2024-20404](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-20404) is a vulnerability in the web-based management interface of Cisco Finesse and related contact center products that allows unauthenticated, remote attackers to perform server-side request forgery (SSRF) attacks. By exploiting insufficient input validation, attackers can send crafted HTTP requests to the affected system, potentially gaining access to limited sensitive information from associated services. This flaw could be leveraged to further probe internal network resources or exfiltrate data, posing a significant risk to organizations using these Cisco solutions.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-20404 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted POST requests to the `/gadgets/metadata` endpoint, embedding external URLs in the JSON body to trigger server-side requests and potentially access sensitive internal resources.

## Timeline

- 2024-06-05: CVE Published. CVE-2024-20404 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2024-20404 exploitation attempts against the CrowdSec Network.

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-rfi-Um7wT8Ew
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-20404.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-20404) follows observed exploitation activity for CVE-2024-20404. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.