Unauthorized Access to Sensitive Information in Cisco IP Phone Firmware

CVE-2024-20378

Summary

A security flaw exists in the web-based management interface of Cisco IP Phone firmware that could enable remote attackers to gain unauthorized access to sensitive information stored on affected devices. The issue stems from inadequate authentication controls for specific endpoints, allowing attackers to connect without prior credentials. Once exploited, this vulnerability permits attackers to capture user credentials and intercept traffic, including VoIP calls, leading to potential replay attacks and data breaches. Organizations utilizing Cisco IP Phones should prioritize applying security patches and implementing additional security measures to mitigate risks associated with this vulnerability.

References