Saturday, May 25, 2024

Cisco IP Phone Vulnerability Let Attackers Trigger DoS Attack

Cisco has disclosed multiple vulnerabilities in its IP Phone firmware that could severely impact users by allowing unauthenticated, remote attackers to perform denial of service (DoS) attacks, gain unauthorized access, and view sensitive information.

These vulnerabilities affect several Cisco IP Phone series models, specifically those running vulnerable firmware versions.

Cisco has responded by releasing software updates to mitigate these vulnerabilities, emphasizing the absence of viable workarounds.

Vulnerable Products

When these weaknesses are present in a vulnerable version of Cisco IP Phone firmware, they affect the following Cisco products:

  • IP Phone 6800 Series with Multiplatform Firmware
  • IP Phone 7800 Series with Multiplatform Firmware
  • IP Phone 8800 Series with Multiplatform Firmware
  • Video Phone 8875 in Multiplatform Mode

Integrate ANY.RUN in Your Company for Effective Malware Analysis

Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

  • Real-time Detection
  • Interactive Malware Analysis
  • Easy to Learn by New Security Team members
  • Get detailed reports with maximum data
  • Set Up Virtual Machine in Linux & all Windows OS Versions
  • Interact with Malware Safely

If you want to test all these features now with completely free access to the sandbox:

CVE-2024-20376: Denial of Service (DoS) Vulnerability

One of the more critical issues, identified as CVE-2024-20376, involves the web-based management interface of the Cisco IP Phone firmware.

This vulnerability allows remote attackers to cause the affected devices to reload unexpectedly, leading to a DoS condition.

The flaw stems from insufficient validation of user-supplied input, which means that an attacker could send a specially crafted request to the interface to exploit this vulnerability.

The impact is severe, with Cisco assigning a high-security impact rating and a CVSS base score of 7.5, indicating significant potential harm.

CVE-2024-20378: Information Disclosure Vulnerability

Another significant vulnerability tracked as CVE-2024-20378 could allow attackers to retrieve sensitive information from affected devices.

This flaw is also located in the web-based management interface and is caused by a lack of authentication for certain endpoints.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.

Successful exploitation could enable attackers to access unauthorized information, potentially leading to further attacks such as the interception of VoIP calls.

This vulnerability shares the same high-security impact rating and a CVSS score of 7.5 as the DoS vulnerability, underscoring its severity.

CVE-2024-20357: Unauthorized Access Vulnerability

The third vulnerability, CVE-2024-20357, concerns the XML service of the Cisco IP Phone firmware and allows remote attackers to initiate phone calls from affected devices without proper authorization.

This issue arises from inadequate bounds-checking during the parsing of XML requests.

Although this vulnerability has a lower CVSS base score of 5.3, indicating a medium level of risk, it could still pose significant threats in specific scenarios, particularly in environments where phone services are critical.

Cisco has not identified any workarounds that could mitigate these vulnerabilities, instead emphasizing the need for affected users to update their firmware to the latest versions provided.

The company has listed detailed information about the fixed software versions for affected devices and urges all users to apply these updates promptly to protect against potential exploits.

For users without service contracts, Cisco advises contacting the Cisco Technical Assistance Center (TAC) with proof of entitlement for access to the necessary software updates.

These vulnerabilities highlight the ongoing challenges and importance of cybersecurity in networked devices.

Users of Cisco IP Phone systems should take immediate action to update their devices to prevent potential cyber-attacks that could exploit these vulnerabilities.

As always, maintaining up-to-date software and being vigilant about network security is crucial in safeguarding against such threats.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles