CVE-2023-20018

CWE-288CWE-863 — Incorrect AuthorizationCWE-8247 documents7 sources
Severity
6.5MEDIUM
EPSS
0.4%
top 40.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
23
Cisco IP Phone 7800 FirmwareCisco IP Phone 7811 FirmwareCisco IP Phone 7821 Firmware+20 more
Timeline
PublishedJan 20
Latest updateDec 30

Description

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally req…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 3.9 | Impact: 4.7

Affected Packages23 packages

▶NVDcisco/ip_phone_7800_firmware< 14.1\(1\)sr2
▶NVDcisco/ip_phone_8800_firmware< 14.1\(1\)sr2
▶NVDcisco/ip_phones_8832_firmware< 14.1\(1\)sr2
▶NVDcisco/ip_phone_7811_firmware< 14.1\(1\)sr2
▶NVDcisco/ip_phone_7821_firmware< 14.1\(1\)sr2

🔴Vulnerability Details

3
OSV
vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd↗2025-12-30
▶
GHSA
GHSA-jc6w-v2gh-gqx3: A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to↗2023-01-20
▶
CVEList
CVE-2023-20018: A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to↗2023-01-19
▶

📋Vendor Advisories

2
Red Hat
kernel: vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd↗2025-12-30
▶
Cisco
Cisco IP Phone 7800 and 8800 Series Web Management Interface Authentication Bypass Vulnerability↗2023-01-11
▶