PT-2021-7232 · Cisco · Cisco Unified Communications Manager+1
Andrew Chi
+2
·
Published
2021-11-02
·
Updated
2022-06-27
·
CVE-2022-20817
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Unified IP Phone (affected versions not specified)
Description
The issue is related to errors in the code of the random number generator in the software of Cisco Unified IP Phones. This could allow a remote attacker to impersonate another user's phone. The vulnerability is due to improper key generation during the manufacturing process, which could result in duplicated keys installed on multiple devices. An attacker could exploit this by performing a machine-in-the-middle attack on the secure communication between the phone and the Cisco Unified Communications Manager (CUCM). A successful exploit could allow the attacker to impersonate another user's phone.
Recommendations
As a temporary workaround, consider implementing additional security measures to the Cisco Unified Communications Manager (CUCM) to minimize the risk of exploitation, such as enhancing the security of the communication between the phone and the CUCM.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Unified Communications Manager
Cisco Unified Ip Phone