CVE-2022-20853

Q: What is the severity of CVE-2022-20853?

CVE-2022-20853 has a CVSS score of 7.4 (HIGH). This CSRF vulnerability in Cisco Expressway Series and TelePresence VCS REST API allows unauthenticated remote attackers to trick authenticated users into executing unauthorized actions. Attackers can exploit this by getting users to click malicious links, potentially causing system reloads. Organizations using affected Cisco collaboration systems are at risk.

7.4 HIGH

Denial of Service CSRF

📋 TL;DR

This CSRF vulnerability in Cisco Expressway Series and TelePresence VCS REST API allows unauthenticated remote attackers to trick authenticated users into executing unauthorized actions. Attackers can exploit this by getting users to click malicious links, potentially causing system reloads. Organizations using affected Cisco collaboration systems are at risk.

💻 Affected Systems

Products:

Cisco Expressway Series
Cisco TelePresence Video Communication Server (VCS)

Versions: Specific versions not provided in description; refer to Cisco advisory for exact ranges

Operating Systems: Cisco proprietary OS

Default Config Vulnerable: ⚠️ Yes

Notes: Affects web-based management interface REST API; requires user interaction with authenticated session

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attacker could cause repeated system reloads leading to denial of service, disrupting video conferencing and collaboration services.

🟠

Likely Case

Temporary service disruption through forced system reloads, causing brief outages in telepresence and collaboration services.

🟢

If Mitigated

No impact if proper CSRF protections are implemented or systems are patched.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires social engineering to trick authenticated users; no authentication needed for initial attack vector

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to Cisco advisory for specific fixed versions

Vendor Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6

Restart Required: Yes

Instructions:

1. Identify affected systems 2. Download appropriate Cisco software updates 3. Apply updates following Cisco documentation 4. Restart systems as required

🧯 If You Can't Patch

Implement network segmentation to restrict access to management interfaces
Use browser extensions that block CSRF attacks and educate users about phishing risks

🔍 How to Verify

Check if Vulnerable:

Check system version against Cisco advisory; examine if CSRF protections are implemented in REST API

Check Version:

Check via Cisco web interface or CLI: show version

Verify Fix Applied:

Verify installed version matches patched version from Cisco advisory; test CSRF protections

📡 Detection & Monitoring

Log Indicators:

Unexpected system reloads
Multiple REST API requests from unusual sources
CSRF token validation failures

Network Indicators:

Unusual HTTP POST requests to management interfaces
Requests lacking proper CSRF tokens

SIEM Query:

Search for: (event_type="system_reload" OR api_call="reload") AND source_ip NOT IN trusted_networks

📊 Metadata

CVE ID: CVE-2022-20853

CVSS v3 Score: 7.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

CWE: CWE-352

Published: November 15, 2024

Last Updated: July 31, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

Telepresence Video Communication Server by Cisco

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata