Cross-Site Request Forgery in Cisco IP Phone Series Management Interface

CVE-2023-20221

Summary

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware allows an unauthenticated, remote attacker to execute cross-site request forgery (CSRF) attacks. This issue arises from insufficient CSRF protections within the interface. An attacker could exploit this vulnerability by tricking an authenticated user into clicking a specially crafted link, potentially leading to unauthorized actions such as a factory reset of the device. Such an exploit could cause a Denial of Service (DoS) condition, disrupting normal operations.

References