Cisco IP Phone Vulnerability Let Attackers Trigger DoS Attack

Cisco has disclosed multiple vulnerabilities in its IP Phone firmware that could severely impact users by allowing unauthenticated, remote attackers to perform denial of service (DoS) attacks, gain unauthorized access, and view sensitive information.

These vulnerabilities affect several Cisco IP Phone series models, specifically those running vulnerable firmware versions.

Cisco has responded by releasing software updates to mitigate these vulnerabilities, emphasizing the absence of viable workarounds.

Vulnerable Products

When these weaknesses are present in a vulnerable version of Cisco IP Phone firmware, they affect the following Cisco products:

• IP Phone 6800 Series with Multiplatform Firmware
• IP Phone 7800 Series with Multiplatform Firmware
• IP Phone 8800 Series with Multiplatform Firmware
• Video Phone 8875 in Multiplatform Mode

Integrate ANY.RUN in Your Company for Effective Malware Analysis

Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

• Real-time Detection
• Interactive Malware Analysis
• Easy to Learn by New Security Team members
• Get detailed reports with maximum data
• Set Up Virtual Machine in Linux & all Windows OS Versions
• Interact with Malware Safely

If you want to test all these features now with completely free access to the sandbox:

Try ANY.RUN for FREE

CVE-2024-20376: Denial of Service (DoS) Vulnerability

One of the more critical issues, identified as CVE-2024-20376, involves the web-based management interface of the Cisco IP Phone firmware.

This vulnerability allows remote attackers to cause the affected devices to reload unexpectedly, leading to a DoS condition.

The flaw stems from insufficient validation of user-supplied input, which means that an attacker could send a specially crafted request to the interface to exploit this vulnerability.

The impact is severe, with Cisco assigning a high-security impact rating and a CVSS base score of 7.5, indicating significant potential harm.

CVE-2024-20378: Information Disclosure Vulnerability

Another significant vulnerability tracked as CVE-2024-20378 could allow attackers to retrieve sensitive information from affected devices.

This flaw is also located in the web-based management interface and is caused by a lack of authentication for certain endpoints.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.

Successful exploitation could enable attackers to access unauthorized information, potentially leading to further attacks such as the interception of VoIP calls.

This vulnerability shares the same high-security impact rating and a CVSS score of 7.5 as the DoS vulnerability, underscoring its severity.

CVE-2024-20357: Unauthorized Access Vulnerability

The third vulnerability, CVE-2024-20357, concerns the XML service of the Cisco IP Phone firmware and allows remote attackers to initiate phone calls from affected devices without proper authorization.

This issue arises from inadequate bounds-checking during the parsing of XML requests.

Although this vulnerability has a lower CVSS base score of 5.3, indicating a medium level of risk, it could still pose significant threats in specific scenarios, particularly in environments where phone services are critical.

Cisco has not identified any workarounds that could mitigate these vulnerabilities, instead emphasizing the need for affected users to update their firmware to the latest versions provided.

The company has listed detailed information about the fixed software versions for affected devices and urges all users to apply these updates promptly to protect against potential exploits.

For users without service contracts, Cisco advises contacting the Cisco Technical Assistance Center (TAC) with proof of entitlement for access to the necessary software updates.

These vulnerabilities highlight the ongoing challenges and importance of cybersecurity in networked devices.

Users of Cisco IP Phone systems should take immediate action to update their devices to prevent potential cyber-attacks that could exploit these vulnerabilities.

As always, maintaining up-to-date software and being vigilant about network security is crucial in safeguarding against such threats.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide