CVE-2023-20018
high-risk
Published 2023-01-20
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.
Do I need to act?
-
0.38% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10
High
NETWORK
/ LOW complexity
Affected Products (20)
Ip Phone 7800 Firmware
Ip Phone 7811 Firmware
Ip Phone 7821 Firmware
Ip Phone 7832 Firmware
Ip Phone 7841 Firmware
Ip Phone 7861 Firmware
Ip Phone 8800 Firmware
Ip Phone 8821 Firmware
Ip Phone 8831 Firmware
Ip Phone 8832 Firmware
Ip Phones 8832 Firmware
Unified Ip Phone 8851Nr Firmware
Unified Ip Phone 8865Nr Firmware
Affected Vendors
References (2)
50
/ 100
high-risk
Severity
29/34 · Critical
Exploitability
1/34 · Minimal
Exposure
20/34 · Moderate