CVE-2023-20078 describes multiple critical vulnerabilities in the web-based management interface of various Cisco IP Phones, allowing unauthenticated, remote attackers to execute arbitrary code or cause a denial of service. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network without user interaction, leading to complete compromise of confidentiality, integrity, and availability. While not currently listed on CISA's KEV or having public Metasploit/Nuclei exploits, it has garnered significant community discussion and media coverage, indicating high awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 11.3.7sr1CPE matchmatch criteria | cpe:2.3:o:cisco:ip_phone_6871_firmware:*:*:*:*:*:*:*:* | ||
< 11.3.7sr1CPE matchmatch criteria | cpe:2.3:o:cisco:ip_phone_6861_firmware:*:*:*:*:*:*:*:* | ||
< 11.3.7sr1CPE matchmatch criteria | cpe:2.3:o:cisco:ip_phone_6851_firmware:*:*:*:*:*:*:*:* | ||
< 11.3.7sr1CPE matchmatch criteria | cpe:2.3:o:cisco:ip_phone_6841_firmware:*:*:*:*:*:*:*:* | ||
< 11.3.7sr1CPE matchmatch criteria | cpe:2.3:o:cisco:ip_phone_6825_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.