Skip to content
fr Sign in
5.9 Medium

CVE-2024-20357 A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to…

Description

A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.

Affected products and versions

Product Affected versions Fixed in
Cisco IP Phones with Multiplatform Firmware 12.0 12.0.1 → 12.0.4 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.3 11.3.1 → 11.3.7 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.2 11.2.1 → 11.2.4 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.1 11.1.1 → 11.1.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.0 11.0.0 → 11.0.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 11 11-3-1MSR2UPG → 11-3-1MPPSR4UPG No fix stated
Cisco IP Phones with Multiplatform Firmware 5.1 5.1.1 → 5.1.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 5.0.1 No fix stated
Cisco IP Phones with Multiplatform Firmware 4.8.1 No fix stated
Show the 18 other branches
Product Affected versions Fixed in
Cisco IP Phones with Multiplatform Firmware 4.7.1 No fix stated
Cisco IP Phones with Multiplatform Firmware 4.5 No fix stated
Cisco PhoneOS 2.3.1 No fix stated
Cisco PhoneOS 2.1.1 No fix stated
Cisco PhoneOS 2.0.1 No fix stated
Cisco PhoneOS 1.0.1 No fix stated
ip_phone_6871_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6821_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6851_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7821_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6861_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6825_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6841_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7811_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7841_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7861_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_8800_series_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
video_phone_8875_firmware 12.0 earliest → 12.0.4 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco IP Phones with Multiplatform Firmware

The 13 CVEs of Cisco IP Phones with Multiplatform Firmware →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20534 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco… 4.8 Medium CVE-2024-20533 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco… 4.8 Medium CVE-2024-20376 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,… 7.5 High
Track this CVE