Paper/Archive/CVE-2023-20078

CVE-2023-20078

Cisco Cisco IP Phones with Multiplatform Firmware — Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities

EPSS 10%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 95.7.957 × 2019.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Affected

ProductAffectedFixed inSource

Cisco IP Phones with Multiplatform Firmwaren/a–CNA

Scores by source

cisco (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP