Main Vulnerability Database Vulnerabilities #VU72698

Input validation error in Cisco Systems, Inc products - CVE-2023-20079

Published: March 1, 2023

Vulnerability identifier: #VU72698

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-20079

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web-based management interface. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Affected software

IP Phone 6800 Series with Multiplatform Firmware
IP Phone 7800 Series with Multiplatform Firmware
Cisco IP Phone 8800 Series with Multiplatform Firmware
Cisco Unified IP Conference Phone 8831
Unified IP Conference Phone 8831 with Multiplatform Firmware
Cisco Unified IP Phone 7900 Series

How to mitigate CVE-2023-20079

Install updates from vendor's website.

IP Phone 6800 Series with Multiplatform Firmware - update to 11.3.7SR1
IP Phone 7800 Series with Multiplatform Firmware - update to 11.3.7SR1
Cisco IP Phone 8800 Series with Multiplatform Firmware - update to 11.3.7SR1
Cisco Unified IP Conference Phone 8831 - update to 11.3.7SR1
Unified IP Conference Phone 8831 with Multiplatform Firmware - update to 11.3.7SR1
Cisco Unified IP Phone 7900 Series - update to 11.3.7SR1

External References

Related Security Bulletins