Input validation error in Cisco Systems, Inc products - CVE-2024-20376
Published: May 2, 2024
Vulnerability identifier: #VU89098
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-20376
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the web-based management interface. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
IP Phone 6800 Series with Multiplatform Firmware
IP Phone 7800 Series with Multiplatform Firmware
Cisco IP Phone 8800 Series with Multiplatform Firmware
Video Phone 8875 in Multiplatform Mode
IP Phone 7800 Series with Multiplatform Firmware
Cisco IP Phone 8800 Series with Multiplatform Firmware
Video Phone 8875 in Multiplatform Mode
How to mitigate CVE-2024-20376
Install updates from vendor's website.
IP Phone 6800 Series with Multiplatform Firmware - update to 12.0.4SR1
IP Phone 7800 Series with Multiplatform Firmware - update to 12.0.4SR1
Cisco IP Phone 8800 Series with Multiplatform Firmware - update to 12.0.4SR1
Video Phone 8875 in Multiplatform Mode - update to 2.3.1.0101
IP Phone 7800 Series with Multiplatform Firmware - update to 12.0.4SR1
Cisco IP Phone 8800 Series with Multiplatform Firmware - update to 12.0.4SR1
Video Phone 8875 in Multiplatform Mode - update to 2.3.1.0101