Unauthorized Remote Execution of Arbitrary Commands on Cisco Small Business IP Phones

CVE-2024-20450

Summary

Vulnerabilities exist in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones that could permit unauthenticated remote attackers to execute arbitrary commands on the device's operating system with root privileges. These issues arise from inadequate error checking of incoming HTTP packets, which can lead to buffer overflow conditions. By sending specially crafted HTTP requests to affected devices, attackers may gain the ability to overflow an internal buffer, ultimately enabling them to execute commands with elevated privileges, potentially compromising the integrity and security of the devices.

References