CVE-2024-20376: cisco cisco ip phones with multiplatform firmware Out-of-bounds Write
Vulnerability summary
CVE-2024-20376 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in cisco cisco ip phones with multiplatform firmware. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities.
Timeline
- 01-05-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the affected device to reload.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
0.00 pp
From 0.88% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco20 products
- cisco ip phones with multiplatform firmware11.3.1 MSR2-6 | 11.3.1 MSR3-3 | 11.3.2 | 11.3.3 | 11.3.1 MSR4-1 | 11.3.4 | 11.3.5 | 11.3.3 MSR2 | 11.3.3 MSR1 | 11.3.6 | 11-3-1MPPSR4UPG | 11.3.7 | 11-3-1MSR2UPG | 11.3.6SR1 | 11.3.7SR1 | 11.3.7SR2 | 11.0.0 | 11.0.1 | 11.0.1 MSR1-1 | 11.0.2 | 11.1.1 | 11.1.1 MSR1-1 | 11.1.1 MSR2-1 | 11.1.2 | 11.1.2 MSR1-1 | 11.1.2 MSR3-1 | 11.2.1 | 11.2.2 | 11.2.3 | 11.2.3 MSR1-1 | 11.2.4 | 11.3.1 | 11.3.1 MSR1-3 | 4.5 | 4.6 MSR1 | 4.7.1 | 4.8.1 | 4.8.1 SR1 | 5.0.1 | 12.0.1 | 12.0.2 | 12.0.3 | 12.0.3SR1 | 12.0.4 | 5.1.1 | 5.1.2 | 5.1(2)SR1
- cisco phoneos1.0.1 | 2.1.1 | 2.0.1 | 2.3.1
- ip_phone_6821_with_multiplatform_firmware≤ 12.0.4
- ip_phone_6841_with_multiplatform_firmware≤ 12.0.4
- ip_phone_6851_with_multiplatform_firmware≤ 12.0.4
1 vendor · 20 products
References
1 links- sec.cloudapps.cisco.com/security/…Vendor Advisory