Skip to content
fr Sign in
5.8 Medium

CVE-2023-20218 A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an…

Description

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco will not release software updates that address this vulnerability. {{value}} ["%7b%7bvalue%7d%7d"])}]]

Affected products and versions

Product Affected versions Fixed in
Cisco Small Business IP Phones 7.6 7.6.0 → 7.6.2 No fix stated
Cisco Small Business IP Phones 7.5 7.5.1 → 7.5.7 No fix stated
Cisco Small Business IP Phones 7.4 7.4.3 → 7.4.9 No fix stated
Cisco Small Business IP Phones 7.3.7 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Small Business IP Phones

The 7 CVEs of Cisco Small Business IP Phones →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20451 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 7.5 High CVE-2024-20454 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical CVE-2024-20450 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical
Track this CVE