CVE-2024-20378

Katalog CVE

CVSS 7.5 · High EPSS 0,81%

Kerentanan Authentication Bypass by Primary Weakness pada cisco ip phone 6821 with multiplatform firmware, cisco ip phone 6841 with multiplatform firmware +13 lainnya. Skor CVSS 3.1 7.5 (High) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed.

Rincian

Terbit di NVD

1 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-305: Authentication Bypass by Primary Weakness

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXA... advisory vendor