CVE-2024-20445 — Sensitive Information Exposure in Cisco IP Conference Phone 7832 Firmware

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.9%
top 24.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
19
Cisco IP Conference Phone 7832 FirmwareCisco IP Conference Phone 8831 FirmwareCisco IP Conference Phone 8832 Firmware+16 more
Timeline
PublishedNov 6

Description

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A succes…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages19 packages

🔴Vulnerability Details

2
CVEList
Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability↗2024-11-06
▶
GHSA
GHSA-hmw9-9w7c-2pm4: A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthen↗2024-11-06
▶

📋Vendor Advisories

1
Cisco
Cisco 7800, 8800, and 9800 Series Phones Information Disclosure Vulnerability↗2024-11-06
▶