CVE-2024-20376

EUVD-2024-18091

01.05.2024, 17:15

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition.  

 This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the affected device to reload.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 69%

Affected Products (NVD)

Vendor	Product	Version
cisco	video_phone_8875_firmware	𝑥 < 2.3.1.0101
cisco	ip_phone_6821_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_6841_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_6851_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_6861_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_6871_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_7811_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_7821_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_7832_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_7841_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_7861_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8811_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8832_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8841_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8845_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8851_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8861_with_multiplatform_firmware	𝑥 ≤ 12.0.4
cisco	ip_phone_8865_with_multiplatform_firmware	𝑥 ≤ 12.0.4

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
cisco	ip_phone_6871_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_6821_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_6851_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_7821_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_6861_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_6825_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_6841_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_7811_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_7841_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_7861_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	ip_phone_8800_series_with_multiplatform_firmware	𝑥 ≤ 12.0.4	ADP
cisco	video_phone_8875_firmware	𝑥 ≤ 12.0.4	ADP

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS