CVE-2023-20078 | ByteOS Network

Vulnerability Details :

CVE-2023-20078

Assigner-cisco

Assigner Org ID-d1c1063e-7a18-46af-9102-31f8928bc633

Published At-03 Mar, 2023 | 00:00

Updated At-28 Oct, 2024 | 16:33

Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:cisco

Assigner Org ID:d1c1063e-7a18-46af-9102-31f8928bc633

Published At:03 Mar, 2023 | 00:00

Updated At:28 Oct, 2024 | 16:33

▼CVE Numbering Authority (CNA)

Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Affected Products

Vendor

Cisco Systems, Inc.

Product

Cisco IP Phones with Multiplatform Firmware

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
CWE	CWE-121	CWE-121

Type: CWE

CWE ID: CWE-121

Description: CWE-121

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploits

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

References

Hyperlink	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP	vendor-advisory

Hyperlink: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP	vendor-advisory x_transferred

Hyperlink: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:ykramarz@cisco.com

Published At:03 Mar, 2023 | 16:15

Updated At:07 Nov, 2023 | 04:05

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

Cisco Systems, Inc.

>>ip_phone_6871_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_6871_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6871>>-

cpe:2.3:h:cisco:ip_phone_6871:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6861_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_6861_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6861>>-

cpe:2.3:h:cisco:ip_phone_6861:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6851_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_6851_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6851>>-

cpe:2.3:h:cisco:ip_phone_6851:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6841_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_6841_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6841>>-

cpe:2.3:h:cisco:ip_phone_6841:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6825_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_6825_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_6825>>-

cpe:2.3:h:cisco:ip_phone_6825:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7861_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7861>>-

cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7841_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7841>>-

cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7832_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_7832_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7832>>-

cpe:2.3:h:cisco:ip_phone_7832:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7821_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7821>>-

cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7811_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_7811>>-

cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8865_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8865>>-

cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8861_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8861>>-

cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8851_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8851>>-

cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8845_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8845>>-

cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8841_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8841>>-

cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8832_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8832_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8832>>-

cpe:2.3:h:cisco:ip_phone_8832:-:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8811_firmware>>Versions before 11.3.7sr1(exclusive)

cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*

Cisco Systems, Inc.

>>ip_phone_8811>>-

cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-121	Secondary	ykramarz@cisco.com

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-121

Type: Secondary

Source: ykramarz@cisco.com

References

Hyperlink	Source	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP	ykramarz@cisco.com	Vendor Advisory

Hyperlink: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP

Source: ykramarz@cisco.com

Resource:

Vendor Advisory