A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials to access the web-based management interface of the affected device.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Cisco Cisco IP Phones with Multiplatform Firmware
4.5, 4.6 MSR1, 4.7.1, 4.8.1, 4.8.1 SR1, 5.0.1, 5.1.1, 5.1.2
- Cisco Cisco Session Initiation Protocol (SIP) Software
9.3(1), 9.1(1), 9.3(1)SR2, 9.4(1), 9.2(2), 9.2(1), 9.3(1)SR1, 9.4(1)SR2, 9.4(1)SR1