Skip to content
fr Sign in
9.8 Critical

CVE-2024-20450 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco…

Description

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.

Affected products and versions

Product Affected versions Fixed in
Cisco Small Business IP Phones 7.6 7.6.0 → 7.6.2 No fix stated
Cisco Small Business IP Phones 7.5 7.5.1 → 7.5.7 No fix stated
Cisco Small Business IP Phones 7.4 7.4.3 → 7.4.9 No fix stated
Cisco Small Business IP Phones 7.3.7 No fix stated
Cisco Small Business IP Phones 1.0.17 No fix stated
small_business_ip_phone_firmware 7.6 7.6.0 → 7.6.2 No fix stated
small_business_ip_phone_firmware 7.5 7.5.1 → 7.5.7 No fix stated
small_business_ip_phone_firmware 7.4 7.4.3 → 7.4.9 No fix stated
small_business_ip_phone_firmware 7.3.7 No fix stated
Show the other branch
Product Affected versions Fixed in
small_business_ip_phone_firmware 1.0.17 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Small Business IP Phones

The 7 CVEs of Cisco Small Business IP Phones →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Medium CVE-2024-20451 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 7.5 High CVE-2024-20454 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco… 9.8 Critical CVE-2023-20181 A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an… 6.1 Medium
Track this CVE