CVE-2023-20221: A vulnerability in the web-based management interface of Cisco IP Phone 680

Description

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform a factory reset of the affected device, resulting in a Denial of Service (DoS) condition.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco IP Phones with Multiplatform Firmware

11.3.1 MSR2-6affected
11.3.1 MSR3-3affected
11.3.2affected
11.3.3affected
11.3.4affected
11.3.5affected
11.3.3 MSR1affected
11.3.6affected
11-3-1MPPSR4UPGaffected
11.3.7affected
11-3-1MSR2UPGaffected
11.3.6SR1affected
11.3.7SR1affected
11.3.7SR2affected
11.0.0affected
11.0.1affected
11.0.1 MSR1-1affected
11.0.2affected
11.1.1affected
11.1.1 MSR1-1affected
11.1.1 MSR2-1affected
11.1.2affected
11.1.2 MSR1-1affected
11.1.2 MSR3-1affected
11.2.1affected
11.2.2affected
11.2.3affected
11.2.3 MSR1-1affected
11.2.4affected
11.3.1affected
11.3.1 MSR1-3affected

Cisco Cisco PhoneOS

1.0.1affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-csrf-HOCmXW2c ↗