5.3

CVE-2024-20445

Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device.

This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records.
Note: Web Access is disabled by default.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Desk Phone 9841 Firmware Version 3.1(1) Update -
   Cisco ≫ Desk Phone 9841 Version -
Cisco ≫ Desk Phone 9841 Firmware Version 3.1(1) Update sr1
   Cisco ≫ Desk Phone 9841 Version -
Cisco ≫ Desk Phone 9851 Firmware Version 3.1(1) Update -
   Cisco ≫ Desk Phone 9851 Version -
Cisco ≫ Desk Phone 9851 Firmware Version 3.1(1) Update sr1
   Cisco ≫ Desk Phone 9851 Version -
Cisco ≫ Desk Phone 9861 Firmware Version 3.1(1) Update -
   Cisco ≫ Desk Phone 9861 Version -
Cisco ≫ Desk Phone 9861 Firmware Version 3.1(1) Update sr1
   Cisco ≫ Desk Phone 9861 Version -
Cisco ≫ Desk Phone 9871 Firmware Version 3.1(1) Update -
   Cisco ≫ Desk Phone 9871 Version -
Cisco ≫ Desk Phone 9871 Firmware Version 3.1(1) Update sr1
   Cisco ≫ Desk Phone 9871 Version -
Cisco ≫ Ip Conference Phone 7832 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Conference Phone 7832 Version -
Cisco ≫ Ip Conference Phone 8831 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Conference Phone 8831 Version -
Cisco ≫ Ip Conference Phone 8832 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Conference Phone 8832 Version -
Cisco ≫ Ip Phone 7811 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 7811 Version -
Cisco ≫ Ip Phone 7821 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 7821 Version -
Cisco ≫ Ip Phone 7841 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 7841 Version -
Cisco ≫ Ip Phone 7861 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 7861 Version -
Cisco ≫ Ip Phone 8811 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 8811 Version -
Cisco ≫ Ip Phone 8841 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 8841 Version -
Cisco ≫ Ip Phone 8845 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 8845 Version -
Cisco ≫ Ip Phone 8851 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 8851 Version -
Cisco ≫ Ip Phone 8851nr Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 8851nr Version -
Cisco ≫ Ip Phone 8861 Firmware Version < 14.3\(1\)
   Cisco ≫ Ip Phone 8861 Version -
Cisco ≫ Video Phone 8875 Firmware Version < 2.3\(1\)
   Cisco ≫ Video Phone 8875 Version -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.365
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-infodisc-sbyqQVbG
Vendor Advisory