Cisco Cisco IP Phones with Multiplatform Firmware
At a glance
- Source
- NVD
- EPSS
- EPSS 0.81 % · percentile 57 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Analyzed
Description
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed.
Weaknesses (CWE)
- CWE-305 — Authentication Bypass by Primary Weakness
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | cisco |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
European references
- ENISA EUVD · EUVD-2024-18093
- GCVE · GCVE-0-2024-20378
CERT-FR advisories
- CERTFR-2024-AVI-0357 — Multiples vulnérabilités dans Cisco IP Phone · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6841_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6841_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6851_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6851_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6861_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6861_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6871_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6871_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7811_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7811_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7821_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7821_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7841_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7841_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7861_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7861_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8851nr_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8851nr_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:video_phone_8875_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 2.3.1.0101
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco IP Phones with Multiplatform Firmware | affected 11.3.1 MSR2-6 ; affected 11.3.1 MSR3-3 ; affected 11.3.2 ; affected 11.3.3 ; affected 11.3.1 MSR4-1 ; affected 11.3.4 |
| Cisco · Cisco PhoneOS | affected 1.0.1 ; affected 2.1.1 ; affected 2.0.1 ; affected 2.3.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |