CVE-2024-20454 is a critical vulnerability affecting Cisco Small Business SPA300 and SPA500 Series IP Phones, allowing unauthenticated, remote attackers to execute arbitrary commands with root privileges via the web-based management interface. The vulnerability stems from improper error checking of incoming HTTP packets, leading to a buffer overflow. With a CVSS score of 9.8 (Critical), exploitation requires no user interaction and grants full control over the device. While not currently listed in CISA's KEV catalog, its high EPSS score and media coverage indicate significant community attention, though public exploit code (Metasploit, Nuclei, ExploitDB) is not yet available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:cisco:spa_301_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:cisco:spa_303_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:cisco:spa_501g_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:cisco:spa_502g_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:cisco:spa_504g_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.