CVE-2024-20357mediumCWE-787

CVE-2024-20357: medium-severity vulnerability in Cisco IP Phones with Multiplatform Firmware

Published · Updated

Follow this CVE+ Monitor Cisco IP Phones with Multiplatform+ Monitor Cisco PhoneOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.5%
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Cisco · Cisco IP Phones with Multiplatform FirmwareCisco · Cisco PhoneOS
Related CVEs — Cisco IP Phones with Multiplatform Firmware

In the same product, most dangerous first.

CVE-2023-20078CRITICALCisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI VulnerabilitiesEPSS 10.4%CVE-2023-20079CRITICALCisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI VulnerabilitiesEPSS 10.3%CVE-2020-3574HIGHCisco IP Phone TCP Packet Flood Denial of Service VulnerabilityEPSS 8.0%CVE-2022-20817HIGHCisco IP Phone Duplicate Key VulnerabilityEPSS 1.2%CVE-2024-20376HIGHCVE-2024-20376EPSS 0.9%CVE-2024-20378HIGHCVE-2024-20378EPSS 0.8%