CVE-2020-3261: Cisco 6300 Series Access Points Firmware

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user with an active session on an affected device to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, including modifying the configuration, with the privilege level of the user.

Affected products

Cisco 6300 Series Access Points Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1542d Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1542i Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1562d Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1562e Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1562i Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1815 Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1830 Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1840 Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 1850 Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 2800e Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 2800i Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 3800e Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 3800i Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 3800p Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Aironet 4800 Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only
Cisco Catalyst IW6300 Firmware: from 8.0, before 8.8.130.0 (fixed in 8.8.130.0); version 8.10(1.255) only

Published 2020-04-15. Last modified 2026-06-17.