Skip to content
fr Sign in
4.8 Medium

CVE-2024-20534 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco…

Description

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform Firmware could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks against users. This vulnerability exists because the web UI of an affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, Web Access must be enabled on the phone and the attacker must have Admin credentials on the device. Web Access is disabled by default.

Affected products and versions

Product Affected versions Fixed in
Cisco IP Phones with Multiplatform Firmware 12.0 12.0.1 → 12.0.5 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.3 11.3.1 → 11.3.7 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.2 11.2.1 → 11.2.4 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.1 11.1.1 → 11.1.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.0 11.0.0 → 11.0.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 11 11-3-1MSR2UPG → 11-3-1MPPSR4UPG No fix stated
Cisco IP Phones with Multiplatform Firmware 5.1.1 No fix stated
Cisco IP Phones with Multiplatform Firmware 5.0.1 No fix stated
Cisco IP Phones with Multiplatform Firmware 4.8.1 No fix stated
Show the 2 other branches
Product Affected versions Fixed in
Cisco IP Phones with Multiplatform Firmware 4.7.1 No fix stated
Cisco Session Initiation Protocol (SIP) Software Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco IP Phones with Multiplatform Firmware

The 13 CVEs of Cisco IP Phones with Multiplatform Firmware →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20533 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco… 4.8 Medium CVE-2024-20376 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,… 7.5 High CVE-2024-20378 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,… 7.5 High
Track this CVE