1. Home
  2. CVE Database
  3. CVE-2024-20445
MEDIUM · 5.3

CVE-2024-20445

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive infor...

Vulnerability Description

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
CiscoDesk Phone 9841 Firmware3.1\(1\)
CiscoDesk Phone 9841-
CiscoDesk Phone 9851 Firmware3.1\(1\)
CiscoDesk Phone 9851-
CiscoDesk Phone 9861 Firmware3.1\(1\)
CiscoDesk Phone 9861-
CiscoDesk Phone 9871 Firmware3.1\(1\)
CiscoDesk Phone 9871-
CiscoIp Conference Phone 7832 Firmware< 14.3\(1\)
CiscoIp Conference Phone 7832-
CiscoIp Conference Phone 8831 Firmware< 14.3\(1\)
CiscoIp Conference Phone 8831-
CiscoIp Conference Phone 8832 Firmware< 14.3\(1\)
CiscoIp Conference Phone 8832-
CiscoIp Phone 7811 Firmware< 14.3\(1\)
CiscoIp Phone 7811-
CiscoIp Phone 7821 Firmware< 14.3\(1\)
CiscoIp Phone 7821-
CiscoIp Phone 7841 Firmware< 14.3\(1\)
CiscoIp Phone 7841-

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2024-20445?

CVE-2024-20445 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive infor...

How severe is CVE-2024-20445?

CVE-2024-20445 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-20445?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Desk Phone 9841 Firmware, Cisco Desk Phone 9841, Cisco Desk Phone 9851 Firmware, Cisco Desk Phone 9851, Cisco Desk Phone 9861 Firmware.