CVE-2024-20451

CVE-2024-20451 describes multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 and SPA500 Series IP Phones. These vulnerabilities, stemming from improper HTTP packet error checking, allow an unauthenticated, remote attacker to send a crafted HTTP packet, causing a denial-of-service (DoS) condition by forcing the device to reload. With a CVSS score of 7.5 (High), the attack requires no user interaction and has low complexity. While there is no known active exploitation, exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion and media coverage, including a BleepingComputer article.