Unauthenticated Remote Attackers Could Execute Arbitrary Commands with Root Privileges

CVE-2024-20454

Summary

The web-based management interface of Cisco Small Business SPA300 Series and SPA500 Series IP Phones contains vulnerabilities that allow unauthenticated remote attackers to exploit a lack of proper error checking in incoming HTTP packets. This oversight can lead to a buffer overflow scenario whereby an attacker sends a specially crafted HTTP request to the vulnerable devices. Upon successful exploitation, the attacker can execute arbitrary commands on the underlying operating system with root privileges, potentially compromising the device and the security of the network within which it operates.

References