Skip to content
fr Sign in
7.5 High

CVE-2024-20378 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,…

Description

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed.

Affected products and versions

Product Affected versions Fixed in
Cisco IP Phones with Multiplatform Firmware 12.0 12.0.1 → 12.0.4 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.3 11.3.1 → 11.3.7 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.2 11.2.1 → 11.2.4 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.1 11.1.1 → 11.1.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 11.0 11.0.0 → 11.0.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 11 11-3-1MSR2UPG → 11-3-1MPPSR4UPG No fix stated
Cisco IP Phones with Multiplatform Firmware 5.1 5.1.1 → 5.1.2 No fix stated
Cisco IP Phones with Multiplatform Firmware 5.0.1 No fix stated
Cisco IP Phones with Multiplatform Firmware 4.8.1 No fix stated
Show the 18 other branches
Product Affected versions Fixed in
Cisco IP Phones with Multiplatform Firmware 4.7.1 No fix stated
Cisco IP Phones with Multiplatform Firmware 4.5 No fix stated
Cisco PhoneOS 2.3.1 No fix stated
Cisco PhoneOS 2.1.1 No fix stated
Cisco PhoneOS 2.0.1 No fix stated
Cisco PhoneOS 1.0.1 No fix stated
ip_phone_6871_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6821_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6851_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7821_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6861_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6825_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_6841_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7811_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7841_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_7861_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
ip_phone_8800_series_with_multiplatform_firmware 12.0 earliest → 12.0.4 No fix stated
video_phone_8875_firmware 12.0 earliest → 12.0.4 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco IP Phones with Multiplatform Firmware

The 13 CVEs of Cisco IP Phones with Multiplatform Firmware →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20534 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco… 4.8 Medium CVE-2024-20533 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco… 4.8 Medium CVE-2024-20376 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,… 7.5 High
Track this CVE