CVE-2024-20378: A vulnerability in the web-based management interface of Cisco IP Phone fir

Description

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco IP Phones with Multiplatform Firmware

11.3.1 MSR2-6affected
11.3.1 MSR3-3affected
11.3.2affected
11.3.3affected
11.3.1 MSR4-1affected
11.3.4affected
11.3.5affected
11.3.3 MSR2affected
11.3.3 MSR1affected
11.3.6affected
11-3-1MPPSR4UPGaffected
11.3.7affected
11-3-1MSR2UPGaffected
11.3.6SR1affected
11.3.7SR1affected
11.3.7SR2affected
11.0.0affected
11.0.1affected
11.0.1 MSR1-1affected
11.0.2affected
11.1.1affected
11.1.1 MSR1-1affected
11.1.1 MSR2-1affected
11.1.2affected
11.1.2 MSR1-1affected
11.1.2 MSR3-1affected
11.2.1affected
11.2.2affected
11.2.3affected
11.2.3 MSR1-1affected
11.2.4affected
11.3.1affected
11.3.1 MSR1-3affected
4.5affected
4.6 MSR1affected
4.7.1affected
4.8.1affected
4.8.1 SR1affected
5.0.1affected
12.0.1affected
12.0.2affected
12.0.3affected
12.0.3SR1affected
12.0.4affected
5.1.1affected
5.1.2affected
5.1(2)SR1affected

Cisco Cisco PhoneOS

1.0.1affected
2.1.1affected
2.0.1affected
2.3.1affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS ↗