4.6

CVE-2022-20660

Exploit

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Ip Conference Phone 7832 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Conference Phone 7832 Version-
Cisco ≫ Ip Conference Phone 8832 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Conference Phone 8832 Version-
Cisco ≫ Ip Phone 7811 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 7811 Version-
Cisco ≫ Ip Phone 7821 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 7821 Version-
Cisco ≫ Ip Phone 7841 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 7841 Version-
Cisco ≫ Ip Phone 7861 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 7861 Version-
Cisco ≫ Ip Phone 8811 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 8811 Version-
Cisco ≫ Ip Phone 8841 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 8841 Version-
Cisco ≫ Ip Phone 8845 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 8845 Version-
Cisco ≫ Ip Phone 8851 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 8851 Version-
Cisco ≫ Ip Phone 8861 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 8861 Version-
Cisco ≫ Ip Phone 8865 Firmware Version < 14.1\(1\)
   Cisco ≫ Ip Phone 8865 Version-
Cisco ≫ Unified Sip Phone 3905 Firmware Version < 9.4\(1\)sr5
   Cisco ≫ Unified Sip Phone 3905 Version-
Cisco ≫ Wireless Ip Phone 8821 Firmware Version < 11.0\(6\)sr2
   Cisco ≫ Wireless Ip Phone 8821 Version-
Cisco ≫ Wireless Ip Phone 8821-ex Firmware Version < 11.0\(6\)sr2
   Cisco ≫ Wireless Ip Phone 8821-ex Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.188
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.6 0.9 3.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
psirt@cisco.com 4.6 0.9 3.6
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

http://seclists.org/fulldisclosure/2022/Jan/34
Third Party Advisory
Mailing List