Authentication Bypass by Primary Weakness in Cisco Systems, Inc products - CVE-2024-20378

Vulnerability identifier: #VU89099

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-20378

CWE-ID: CWE-305

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a lack of authentication for specific endpoints of the web-based management interface. A remote attacker can gain unauthorized access to sensitive information on the system.

IP Phone 6800 Series with Multiplatform Firmware
IP Phone 7800 Series with Multiplatform Firmware
Cisco IP Phone 8800 Series with Multiplatform Firmware
Video Phone 8875 in Multiplatform Mode

Install updates from vendor's website.

IP Phone 6800 Series with Multiplatform Firmware - update to 12.0.4SR1
IP Phone 7800 Series with Multiplatform Firmware - update to 12.0.4SR1
Cisco IP Phone 8800 Series with Multiplatform Firmware - update to 12.0.4SR1
Video Phone 8875 in Multiplatform Mode - update to 2.3.1.0101

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS

• Multiple vulnerabilities in Cisco IP Phone 6800, 7800 and 8800 Series with Multiplatform Firmware