PT-2023-1613 · Cisco · Cisco Ip Phone 7800+2

Zack Sanchez · Published 2023-03-01 · Updated 2023-03-10 · CVE-2023-20079

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 6800 versions (affected versions not specified) Cisco IP Phone 7800 versions (affected versions not specified) Cisco IP Phone 8800 versions (affected versions not specified)

Description The issue is related to the web-based management interface of certain Cisco IP Phones, which could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. This could lead to a disruption in service.

Recommendations For Cisco IP Phone 6800, update to a version that addresses the vulnerability. For Cisco IP Phone 7800, update to a version that addresses the vulnerability. For Cisco IP Phone 8800, update to a version that addresses the vulnerability. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Fix

Stack Overflow

RCE

Memory Corruption

Weakness Enumeration

CWE-121

CWE-20

CWE-787

Related Identifiers

BDU:2023-01115

CVE-2023-20079

Affected Products

Cisco Ip Phone 6800

Cisco Ip Phone 7800

Cisco Ip Phone 8800

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-cmd-inj-KMFynVcP · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01115 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20079 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20079 · Vendor Advisory
• https://t.me/cibsecurity/59376 · Telegram Post
• https://t.me/true_secator/4123 · Telegram Post
• https://t.me/isacarusec/5940 · Telegram Post
• https://t.me/cvenotify/45447 · Telegram Post