CVE-2022-20774

06.04.2022, 19:15

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform configuration changes on the affected device, resulting in a denial of service (DoS) condition.

CSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
cisco	CNA	6.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 48%

Vendor	Product	Version
cisco	ip_phone_6871_firmware	𝑥 < 11.3.5
cisco	ip_phone_6861_firmware	𝑥 < 11.3.5
cisco	ip_phone_6851_firmware	𝑥 < 11.3.5
cisco	ip_phone_6841_firmware	𝑥 < 11.3.5
cisco	ip_phone_6825_firmware	𝑥 < 11.3.5
cisco	ip_phone_7861_firmware	𝑥 < 11.3.5
cisco	ip_phone_7841_firmware	𝑥 < 11.3.5
cisco	ip_phone_7832_firmware	𝑥 < 11.3.5
cisco	ip_phone_7821_firmware	𝑥 < 11.3.5
cisco	ip_phone_7811_firmware	𝑥 < 11.3.5
cisco	ip_phone_8865_firmware	𝑥 < 11.3.5
cisco	ip_phone_8861_firmware	𝑥 < 11.3.5
cisco	ip_phone_8851_firmware	𝑥 < 11.3.5
cisco	ip_phone_8845_firmware	𝑥 < 11.3.5
cisco	ip_phone_8841_firmware	𝑥 < 11.3.5
cisco	ip_phone_8832_firmware	𝑥 < 11.3.5
cisco	ip_phone_8811_firmware	𝑥 < 11.3.5

𝑥

= Vulnerable software versions

Common Weakness Enumeration

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-csrf-K56vXvVx