Cisco Cisco IP Phones with Multiplatform Firmware
En bref
- Source
- NVD
- EPSS
- EPSS 0.81 % · centile 57 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Analyzed
Rechercher sur…
Description
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed.
Faiblesses (CWE)
- CWE-305 — Contournement d'authentification par faiblesse primaire
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | cisco |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-18093
- GCVE · GCVE-0-2024-20378
Avis du CERT-FR
- CERTFR-2024-AVI-0357 — Multiples vulnérabilités dans Cisco IP Phone · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6841_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6841_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6851_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6851_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6861_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6861_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_6871_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_6871_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7811_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7811_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7821_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7821_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7841_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7841_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_7861_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_7861_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8851nr_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8851nr_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 12.0.4cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:12.0.4:-:*:*:*:*:*:*cpe:2.3:o:cisco:video_phone_8875_with_multiplatform_firmware:*:*:*:*:*:*:*:*< 2.3.1.0101
Produits affectés
| Produit | Versions |
|---|---|
| Cisco · Cisco IP Phones with Multiplatform Firmware | affected 11.3.1 MSR2-6 ; affected 11.3.1 MSR3-3 ; affected 11.3.2 ; affected 11.3.3 ; affected 11.3.1 MSR4-1 ; affected 11.3.4 |
| Cisco · Cisco PhoneOS | affected 1.0.1 ; affected 2.1.1 ; affected 2.0.1 ; affected 2.3.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |