PT-2024-8290 · Cisco · Cisco Ip Phone 7800+4

Ian Thorne · Published 2024-11-06 · Updated 2026-01-05 · CVE-2024-20534

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 6800 versions (affected versions not specified) Cisco IP Phone 7800 versions (affected versions not specified) Cisco IP Phone 8800 versions (affected versions not specified) Cisco Video Phone 8875 versions (affected versions not specified) Cisco Desk Phone 9800 Series versions (affected versions not specified)

Description The vulnerability is related to the web interface of the affected devices, which does not properly validate user-supplied input. This could allow a remote attacker to conduct stored cross-site scripting (XSS) attacks against users. The attacker must have Admin credentials on the device and Web Access must be enabled on the phone to exploit this vulnerability. Web Access is disabled by default. The vulnerability exists because the web UI of an affected device does not properly validate user-supplied input, allowing an attacker to inject malicious code into specific pages of the interface.

Recommendations For Cisco IP Phone 6800, update to a version that fixes the vulnerability, ensuring Web Access is disabled if not necessary. For Cisco IP Phone 7800, update to a version that fixes the vulnerability, ensuring Web Access is disabled if not necessary. For Cisco IP Phone 8800, update to a version that fixes the vulnerability, ensuring Web Access is disabled if not necessary. For Cisco Video Phone 8875, update to a version that fixes the vulnerability, ensuring Web Access is disabled if not necessary. For Cisco Desk Phone 9800 Series, update to a version that fixes the vulnerability, ensuring Web Access is disabled if not necessary. As a temporary workaround, consider disabling Web Access on the affected devices until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-09843

CVE-2024-20534

Affected Products

Cisco Desk Phone 9800 Series

Cisco Ip Phone 6800

Cisco Ip Phone 7800

Cisco Ip Phone 8800

Cisco Video Phone 8875

References · 8

• https://osv.dev/vulnerability/CVE-2024-20534 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mpp-xss-8tAV2TvF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20534 · Security Note
• https://bdu.fstec.ru/vul/2024-09843 · Security Note
• https://t.me/cvedetector/10024 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854278533427654848 · Twitter Post
• https://twitter.com/CVEnew/status/1854203356677312687 · Twitter Post
• https://t.me/cveNotify/147700 · Telegram Post