This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes 3 vulnerabilities in IP Phone 6800, 7800, 8800 and Video Phone 8875 products
Cisco Multiplatform Firmware version 12.0.4SR1 and PhoneOS version 2.3.1.0101 fix high-severity vulnerabilities affecting IP Phone 6800, 7800, 8800 and Video Phone 8875 products [1].
An unauthenticated remote attacker can, due to insufficient validation of user-supplied input, cause the affected device to restart, which may lead to a denial-of-service condition [1].
The vulnerability is present in products:
- Cisco Multiplatform Firmware; <12.0.4SR1
- Cisco PhoneOS; <2.3.1.0101
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-20376 at cve.org, NVD
- CWE-787 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 5. 2024.
An unauthenticated remote attacker can, due to insufficient validation of endpoints of the web management interface, obtain sensitive information from the affected device [1].
The vulnerability is present in products:
- Cisco Multiplatform Firmware; <12.0.4SR1
- Cisco PhoneOS; <2.3.1.0101
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-20378 at cve.org, NVD
- CWE-305 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 5. 2024.
An unauthenticated remote attacker can, due to insufficient boundary checks when processing XML requests, initiate calls or play audio on the affected device [1].
The vulnerability is present in products:
- Cisco Multiplatform Firmware; <12.0.4SR1
- Cisco PhoneOS; <2.3.1.0101
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2024-20357 at cve.org, NVD
- CWE-787 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 5. 2024.
By CESNET, z.s.p.o. Michaela Jarošová on 20. 5. 2024.