CVE-2024-20445
moderate-risk
Published 2024-11-06
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default.
Do I need to act?
-
0.90% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10
Medium
NETWORK
/ LOW complexity
Affected Products (20)
Desk Phone 9841 Firmware
Desk Phone 9841 Firmware
Desk Phone 9851 Firmware
Desk Phone 9851 Firmware
Desk Phone 9861 Firmware
Desk Phone 9861 Firmware
Desk Phone 9871 Firmware
Desk Phone 9871 Firmware
Ip Conference Phone 7832 Firmware
Ip Conference Phone 8831 Firmware
Ip Conference Phone 8832 Firmware
Ip Phone 7811 Firmware
Ip Phone 7821 Firmware
Ip Phone 7841 Firmware
Ip Phone 7861 Firmware
Ip Phone 8851Nr Firmware
Affected Vendors
References (1)
45
/ 100
moderate-risk
Severity
21/34 · High
Exploitability
3/34 · Minimal
Exposure
21/34 · High