CVE-2024-20378
Assigner: cisco
Published: 2024-05-01T16:41:52.385Z
State: PUBLISHED
descriptions: value: A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device.  
 This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed.
affected: vendor: Cisco
product: Cisco IP Phones with Multiplatform Firmware
versions: version: 11.3.1 MSR2-6
status: affected
version: 11.3.1 MSR3-3
status: affected
version: 11.3.2
status: affected
version: 11.3.3
status: affected
version: 11.3.1 MSR4-1
status: affected
version: 11.3.4
status: affected
version: 11.3.5
status: affected
version: 11.3.3 MSR2
status: affected
version: 11.3.3 MSR1
status: affected
version: 11.3.6
status: affected
version: 11-3-1MPPSR4UPG
status: affected
version: 11.3.7
status: affected
version: 11-3-1MSR2UPG
status: affected
version: 11.3.6SR1
status: affected
version: 11.3.7SR1
status: affected
version: 11.3.7SR2
status: affected
version: 11.0.0
status: affected
version: 11.0.1
status: affected
version: 11.0.1 MSR1-1
status: affected
version: 11.0.2
status: affected
version: 11.1.1
status: affected
version: 11.1.1 MSR1-1
status: affected
version: 11.1.1 MSR2-1
status: affected
version: 11.1.2
status: affected
version: 11.1.2 MSR1-1
status: affected
version: 11.1.2 MSR3-1
status: affected
version: 11.2.1
status: affected
version: 11.2.2
status: affected
version: 11.2.3
status: affected
version: 11.2.3 MSR1-1
status: affected
version: 11.2.4
status: affected
version: 11.3.1
status: affected
version: 11.3.1 MSR1-3
status: affected
version: 4.5
status: affected
version: 4.6 MSR1
status: affected
version: 4.7.1
status: affected
version: 4.8.1
status: affected
version: 4.8.1 SR1
status: affected
version: 5.0.1
status: affected
version: 12.0.1
status: affected
version: 12.0.2
status: affected
version: 12.0.3
status: affected
version: 12.0.3SR1
status: affected
version: 12.0.4
status: affected
version: 5.1.1
status: affected
version: 5.1.2
status: affected
version: 5.1(2)SR1
status: affected
vendor: Cisco
product: Cisco PhoneOS
versions: version: 1.0.1
status: affected
version: 2.1.1
status: affected
version: 2.0.1
status: affected
version: 2.3.1
status: affected
problemTypes: descriptions: description: Authentication Bypass by Primary Weakness
type: cwe
cweId: CWE-305
metrics: format: cvssV3_1
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
source: advisory: cisco-sa-ipphone-multi-vulns-cXAhCvS
discovery: EXTERNAL
defects: CSCwi64037
CSCwi64050