7.4
Élevée
CVE-2022-20817 A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's…
Description
A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco IP Phones with Multiplatform Firmware | Versions non publiées |
Références
- 20220615 Cisco IP Phone Duplicate Key Vulnerability tools.cisco.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Cisco IP Phones with Multiplatform Firmware
Les 13 CVE de Cisco IP Phones with Multiplatform Firmware →
CVE-2021-1379
Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations…
6.5
Moyenne
CVE-2024-20534
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco…
4.8
Moyenne
CVE-2024-20533
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco…
4.8
Moyenne
CVE-2024-20376
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,…
7.5
Élevée