CVE-2024-20357
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because boun
Severity
Medium 5.9
CVSS 3.1
Exploited
Not listed
EPSS
0.005
41.8th percentile
Discovered by
Third party
Vendor-published field
Published
May 1, 2024
Assigned by cisco
Description
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
Weakness: CWE-787
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco IP Phones | Other Products | cna-assigner |
Vendor-reported products (14)
- Cisco · Cisco IP Phones with Multiplatform Firmware
- Cisco · Cisco PhoneOS
- cisco · ip_phone_6871_with_multiplatform_firmware
- cisco · ip_phone_6821_with_multiplatform_firmware
- cisco · ip_phone_6851_with_multiplatform_firmware
- cisco · ip_phone_7821_with_multiplatform_firmware
- cisco · ip_phone_6861_with_multiplatform_firmware
- cisco · ip_phone_6825_with_multiplatform_firmware
- cisco · ip_phone_6841_with_multiplatform_firmware
- cisco · ip_phone_7811_with_multiplatform_firmware
- cisco · ip_phone_7841_with_multiplatform_firmware
- cisco · ip_phone_7861_with_multiplatform_firmware
- cisco · ip_phone_8800_series_with_multiplatform_firmware
- cisco · video_phone_8875_firmware