CVE-2024-20395
Cisco Webex Teams 3.0.13464.0 … 43.4.0.25788
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20395 is a medium-severity Unprotected Transport of Credentials (CWE-523) vulnerability in Cisco Webex Teams. Its CVSS base score is 6.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Proc Filesystem (T1003.007); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18110
Vulnerability Data
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses…
more
embedded media, such as images. An attacker could exploit this vulnerability by sending a message with embedded media that is stored on a messaging server to a targeted user. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture session token information from insecurely transmitted requests and possibly reuse the captured session information to take further actions as the targeted user.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-8 requires confidentiality protection for transmitted data, directly stopping credentials from traveling in plaintext.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure information transfer, which can include protecting credentials in transit.
Addresses management of authentication information, indirectly supporting protection during transmission.
Requires network security controls that can protect credential transmission.
A.8.21 mandates identifying/implementing network service security features including authentication, encryption, and connection controls plus rules on allowed networks, authentication requirements, and monitoring; this directly stops in-transit credential exposure for most network-based logins (e.g. via mandated TLS), with a bounded remainder of non-network or non-service-mediated credential flows.
Requires use of cryptography, directly enabling encryption of credentials in transit.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
RHEL 8 (2 rules)
- V-230487 RHEL 8 must not have the telnet-server package installed. blocks CWE-523
- V-230492 RHEL 8 must not have the rsh-server package installed. blocks CWE-523