PT-2024-5449 · Cisco · Cisco Small Business Spa300 Series Ip Phones+1
Published
2024-08-07
·
Updated
2024-08-23
·
CVE-2024-20450
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco Small Business SPA300 Series IP Phones (affected versions not specified)
Cisco Small Business SPA500 Series IP Phones (affected versions not specified)
Description
The issue is related to a buffer overflow vulnerability in the web-based management interface of the affected IP phones, caused by insufficient error checking of incoming HTTP packets. This could allow a remote attacker to execute arbitrary commands on the underlying operating system with root privileges by sending a crafted HTTP request. The vulnerability is actively being exploited.
Recommendations
For Cisco Small Business SPA300 Series IP Phones, update to a version that includes the fix for this issue.
For Cisco Small Business SPA500 Series IP Phones, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Small Business Spa300 Series Ip Phones
Cisco Small Business Spa500 Series Ip Phones