CVE-2020-3261: Cisco Mobility Express Software Cross-Site Request Forgery Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-15 · updated 2026-06-17
Weakness: CWE-352

Description

A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user with an active session on an affected device to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, including modifying the configuration, with the privilege level of the user.

Affected products

Cisco 6300 Series Access Points Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1542D Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1542I Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1562D Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1562E Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1562I Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1815 Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1830 Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1840 Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 1850 Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 2800E Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 2800I Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 3800E Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 3800I Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 3800P Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Aironet 4800 Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0
Cisco Catalyst Iw6300 Firmware: from 8.0 before 8.8.130.0; 8.10(1.255) — fixed in 8.8.130.0

How to fix

Upgrade to a fixed version: Cisco 6300 Series Access Points Firmware 8.8.130.0; Cisco Aironet 1542D Firmware 8.8.130.0; Cisco Aironet 1542I Firmware 8.8.130.0; Cisco Aironet 1562D Firmware 8.8.130.0; Cisco Aironet 1562E Firmware 8.8.130.0; Cisco Aironet 1562I Firmware 8.8.130.0; Cisco Aironet 1815 Firmware 8.8.130.0; Cisco Aironet 1830 Firmware 8.8.130.0; Cisco Aironet 1840 Firmware 8.8.130.0; Cisco Aironet 1850 Firmware 8.8.130.0; Cisco Aironet 2800E Firmware 8.8.130.0; Cisco Aironet 2800I Firmware 8.8.130.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3261 or the next vulnerability affects your stack