CVE-2024-20357: A vulnerability in the XML service of Cisco IP Phone firmware could allow a

Description

A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco IP Phones with Multiplatform Firmware

11.3.1 MSR2-6affected
11.3.1 MSR3-3affected
11.3.2affected
11.3.3affected
11.3.1 MSR4-1affected
11.3.4affected
11.3.5affected
11.3.3 MSR2affected
11.3.3 MSR1affected
11.3.6affected
11-3-1MPPSR4UPGaffected
11.3.7affected
11-3-1MSR2UPGaffected
11.3.6SR1affected
11.3.7SR1affected
11.3.7SR2affected
11.0.0affected
11.0.1affected
11.0.1 MSR1-1affected
11.0.2affected
11.1.1affected
11.1.1 MSR1-1affected
11.1.1 MSR2-1affected
11.1.2affected
11.1.2 MSR1-1affected
11.1.2 MSR3-1affected
11.2.1affected
11.2.2affected
11.2.3affected
11.2.3 MSR1-1affected
11.2.4affected
11.3.1affected
11.3.1 MSR1-3affected
4.5affected
4.6 MSR1affected
4.7.1affected
4.8.1affected
4.8.1 SR1affected
5.0.1affected
12.0.1affected
12.0.2affected
12.0.3affected
12.0.3SR1affected
12.0.4affected
5.1.1affected
5.1.2affected
5.1(2)SR1affected

Cisco Cisco PhoneOS

1.0.1affected
2.1.1affected
2.0.1affected
2.3.1affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS ↗