CVE-2024-20445
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device.
Does this matter?
Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.44% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- cisco/desk phone 9841 firmware · cisco/desk phone 9851 firmware · cisco/desk phone 9861 firmware · cisco/desk phone 9871 firmware · cisco/ip conference phone 7832 firmware · cisco/ip conference phone 8831 firmware · cisco/ip conference phone 8832 firmware · cisco/ip phone 7811 firmware · cisco/ip phone 7821 firmware · cisco/ip phone 7841 firmware · cisco/ip phone 7861 firmware · cisco/ip phone 8811 firmware · cisco/ip phone 8841 firmware · cisco/ip phone 8845 firmware · cisco/ip phone 8851 firmware · cisco/ip phone 8851nr firmware · cisco/ip phone 8861 firmware · cisco/video phone 8875 firmware
- Source
- psirt@cisco.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.