CVE-2020-3111: cisco cisco ip phone Improper Input Validation

Vulnerability summary

CVE-2020-3111 is a high (CVSS 8.8) Improper Input Validation vulnerability in cisco cisco ip phone. EPSS estimates a 3.09% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities.

Timeline

1. 05-02-2020
   PublishedVulnerability first disclosed.
2. 15-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to the targeted IP phone. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.