CVE-2024-20376: A vulnerability in the web-based management interface of Cisco IP Phone fir

Description

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the affected device to reload.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco IP Phones with Multiplatform Firmware

11.3.1 MSR2-6affected
11.3.1 MSR3-3affected
11.3.2affected
11.3.3affected
11.3.1 MSR4-1affected
11.3.4affected
11.3.5affected
11.3.3 MSR2affected
11.3.3 MSR1affected
11.3.6affected
11-3-1MPPSR4UPGaffected
11.3.7affected
11-3-1MSR2UPGaffected
11.3.6SR1affected
11.3.7SR1affected
11.3.7SR2affected
11.0.0affected
11.0.1affected
11.0.1 MSR1-1affected
11.0.2affected
11.1.1affected
11.1.1 MSR1-1affected
11.1.1 MSR2-1affected
11.1.2affected
11.1.2 MSR1-1affected
11.1.2 MSR3-1affected
11.2.1affected
11.2.2affected
11.2.3affected
11.2.3 MSR1-1affected
11.2.4affected
11.3.1affected
11.3.1 MSR1-3affected
4.5affected
4.6 MSR1affected
4.7.1affected
4.8.1affected
4.8.1 SR1affected
5.0.1affected
12.0.1affected
12.0.2affected
12.0.3affected
12.0.3SR1affected
12.0.4affected
5.1.1affected
5.1.2affected
5.1(2)SR1affected

Cisco Cisco PhoneOS

1.0.1affected
2.1.1affected
2.0.1affected
2.3.1affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS ↗