Denial of Service Vulnerability in Cisco Webex Devices

CVE-2023-20047

Summary

A vulnerability exists in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices. This issue arises from insufficient resource allocation, enabling an unauthenticated adjacent attacker to disrupt device operations by sending specially crafted LLDP traffic. Successful exploitation can lead to memory resource exhaustion, causing the LLDP process to crash. If the affected device is solely configured for LLDP support, this results in a significant interruption to inbound and outbound calls. The default configuration allows support for both LLDP and Cisco Discovery Protocol. Recovery from this disruption necessitates a manual restart of the affected device.

References