Skip to content
fr Sign in
6.1 Medium

CVE-2023-20181 A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an…

Description

A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected products and versions

Product Affected versions Fixed in
Cisco Small Business IP Phones 7.6 7.6.0 → 7.6.2 No fix stated
Cisco Small Business IP Phones 7.5 7.5.1 → 7.5.7 No fix stated
Cisco Small Business IP Phones 7.4 7.4.3 → 7.4.9 No fix stated
Cisco Small Business IP Phones 7.3.7 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Small Business IP Phones

The 7 CVEs of Cisco Small Business IP Phones →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20451 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 7.5 High CVE-2024-20454 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical CVE-2024-20450 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical
Track this CVE