Cisco Cisco IP Phones with Multiplatform Firmware
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Modified
Description
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform a factory reset of the affected device, resulting in a Denial of Service (DoS) condition.
Weaknesses (CWE)
- CWE-352 — Cross-Site Request Forgery
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | cisco |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-24400
- GCVE · GCVE-0-2023-20221
Affected configurations (NVD CPE)
cpe:2.3:o:cisco:video_phone_8875_firmware:*:*:*:*:*:*:*:*< 2.0cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11-3-1msr2upg:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.0.0:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.0.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.0.1_msr1-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.0.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.1.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.1.1_msr1-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.1.1_msr2-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.1.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.1.2_msr1-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.1.2_msr3-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.2.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.2.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.2.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.2.3_msr1-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.2.4:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.1_msr1-3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.1_msr2-6:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.1_msr3-3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.3:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.3_msr1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.4:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.5:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.6:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.6sr1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.7:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.7sr1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11.3.7sr2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11-3-1msr2upg:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11.0.0:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11.0.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11.0.1_msr1-1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11.0.2:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11.1.1:*:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11.1.1_msr1-1:*:*:*:*:*:*:*- +643 more
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco IP Phones with Multiplatform Firmware | affected 11.3.1 MSR2-6 ; affected 11.3.1 MSR3-3 ; affected 11.3.2 ; affected 11.3.3 ; affected 11.3.4 ; affected 11.3.5 |
| Cisco · Cisco PhoneOS | affected 1.0.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |