Skip to content
fr Sign in
9.8 Critical

CVE-2023-20126 A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an…

Description

A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges. Cisco has not released firmware updates to address this vulnerability.

Affected products and versions

Product Affected versions Fixed in
Cisco Small Business IP Phones Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Small Business IP Phones

The 7 CVEs of Cisco Small Business IP Phones →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20451 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 7.5 High CVE-2024-20454 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical CVE-2024-20450 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical
Track this CVE