Aller au contenu
en Se connecter
4.8 Moyenne

CVE-2024-20534 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco…

Description

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform Firmware could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks against users. This vulnerability exists because the web UI of an affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, Web Access must be enabled on the phone and the attacker must have Admin credentials on the device. Web Access is disabled by default.

Produits et versions touchés

Produit Versions touchées Corrigé en
Cisco IP Phones with Multiplatform Firmware 12.0 12.0.1 → 12.0.5 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 11.3 11.3.1 → 11.3.7 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 11.2 11.2.1 → 11.2.4 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 11.1 11.1.1 → 11.1.2 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 11.0 11.0.0 → 11.0.2 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 11 11-3-1MSR2UPG → 11-3-1MPPSR4UPG Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 5.1.1 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 5.0.1 Pas de correctif indiqué
Cisco IP Phones with Multiplatform Firmware 4.8.1 Pas de correctif indiqué
Afficher les 2 autres branches
Produit Versions touchées Corrigé en
Cisco IP Phones with Multiplatform Firmware 4.7.1 Pas de correctif indiqué
Cisco Session Initiation Protocol (SIP) Software Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Cisco IP Phones with Multiplatform Firmware

Les 13 CVE de Cisco IP Phones with Multiplatform Firmware →
CVE-2021-1379 Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations… 6.5 Moyenne CVE-2024-20533 A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco… 4.8 Moyenne CVE-2024-20376 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,… 7.5 Élevée CVE-2024-20378 A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated,… 7.5 Élevée
Suivre cette CVE