CVE-2023-20079

published 2023-03-03

CVE-2023-20079: Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_ip_phones_with_multiplatform_firmware	—	—
cisco	ip_phone_6800_7800_and_8800_series	—	—
cisco	ip_phone_6825_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_6841_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_6851_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_6861_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_6871_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_7811_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_7821_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_7832_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_7841_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_7861_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8811_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8831_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8832_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8841_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8845_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8851_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8861_firmware	< 11.3.7sr1	11.3.7sr1
cisco	ip_phone_8865_firmware	< 11.3.7sr1	11.3.7sr1
cisco	unified_ip_phone_7945g_firmware	< 11.3.7sr1	11.3.7sr1
cisco	unified_ip_phone_7965g_firmware	< 11.3.7sr1	11.3.7sr1
cisco	unified_ip_phone_7975g_firmware	< 11.3.7sr1	11.3.7sr1

CWE-121 CWE-787 CWE-78