cvelistv5 - CVE-2023-20018

CVE-2023-20018 (GCVE-0-2023-20018)

Vulnerability from cvelistv5 – Published: 2023-01-19 01:35 – Updated: 2024-08-02 08:57

Summary

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.

Severity ?

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

cisco

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Session Initiation Protocol (SIP) Software	Affected: 9.3(4) 3rd Party Affected: 9.3(4)SR3 3rd Party Affected: 9.3(4)SR1 3rd Party Affected: 9.3(4)SR2 3rd Party Affected: 11.0(3)SR3 Affected: 11.0(2)SR1 Affected: 11.5(1) Affected: 11.0(5)SR2 Affected: 11.0(2) Affected: 11.7(1) Affected: 11.0(4)SR3 Affected: 11.0(0.7) MPP Affected: 11.0(4)SR2 Affected: 11.0(3)SR5 Affected: 11.0(3)SR6 Affected: 11.0(3) Affected: 11.0(4)SR1 Affected: 11.0(1) MPP Affected: 11.0(4) Affected: 11.0(3)SR4 Affected: 11.0(5) Affected: 11.0(3)SR1 Affected: 11.0(5)SR1 Affected: 11.0(3)SR2 Affected: 11.0(2)SR2 Affected: 11.0(1) Affected: 11.5(1)SR1 Affected: 11-0-1MSR1-1 Affected: 10.4(1) 3rd Party Affected: 10.3(1.11) 3rd Party Affected: 10.2(2) Affected: 10.2(1)SR1 Affected: 10.1(1.9) Affected: 10.1(1)SR2 Affected: 10.2(1) Affected: 10.1(1)SR1 Affected: 10.4(1)SR2 3rd Party Affected: 10.3(1) Affected: 10.3(1)SR4b Affected: 10.3(1)SR5 Affected: 10.3(1.9) 3rd Party Affected: 10.3(2) Affected: 10.3(1)SR4 Affected: 10.3(1)SR2 Affected: 10.3(1)SR3 Affected: 10.3(1)SR1 Affected: 12.6(1) Affected: 12.1(1) Affected: 12.5(1)SR1 Affected: 12.5(1)SR2 Affected: 12.5(1) Affected: 12.5(1)SR3 Affected: 12.6(1)SR1 Affected: 12.7(1) Affected: 12.1(1)SR1 Affected: 12.0(1) Affected: 12.0(1)SR2 Affected: 12.0(1)SR1 Affected: 12.0(1)SR3 Affected: 12.8(1) Affected: 12.8(1)SR1 Affected: 12.8(1)SR2 Affected: 11.0(5)SR3 Affected: 11.0(6) Affected: 11.0(6)SR1 Affected: 11.0(6)SR2 Affected: 10.3(1)SR6 Affected: 10.3(1)SR7 Affected: 12.7(1)SR1 Affected: 14.0(1)SR1 Affected: 14.0(1) Affected: 14.0(1)SR2 Affected: 14.0(1)SR3 Affected: 14.1(1) Affected: 14.1(1)SR1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:57:35.086Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Session Initiation Protocol (SIP) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "9.3(4) 3rd Party"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR3 3rd Party"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR1 3rd Party"
            },
            {
              "status": "affected",
              "version": "9.3(4)SR2 3rd Party"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(2)SR1"
            },
            {
              "status": "affected",
              "version": "11.5(1)"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(2)"
            },
            {
              "status": "affected",
              "version": "11.7(1)"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(0.7) MPP"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR5"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR6"
            },
            {
              "status": "affected",
              "version": "11.0(3)"
            },
            {
              "status": "affected",
              "version": "11.0(4)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(1) MPP"
            },
            {
              "status": "affected",
              "version": "11.0(4)"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR4"
            },
            {
              "status": "affected",
              "version": "11.0(5)"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(3)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(2)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(1)"
            },
            {
              "status": "affected",
              "version": "11.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "11-0-1MSR1-1"
            },
            {
              "status": "affected",
              "version": "10.4(1) 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(1.11) 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.2(2)"
            },
            {
              "status": "affected",
              "version": "10.2(1)SR1"
            },
            {
              "status": "affected",
              "version": "10.1(1.9)"
            },
            {
              "status": "affected",
              "version": "10.1(1)SR2"
            },
            {
              "status": "affected",
              "version": "10.2(1)"
            },
            {
              "status": "affected",
              "version": "10.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "10.4(1)SR2 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR4b"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR5"
            },
            {
              "status": "affected",
              "version": "10.3(1.9) 3rd Party"
            },
            {
              "status": "affected",
              "version": "10.3(2)"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR4"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR2"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR3"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.6(1)"
            },
            {
              "status": "affected",
              "version": "12.1(1)"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR2"
            },
            {
              "status": "affected",
              "version": "12.5(1)"
            },
            {
              "status": "affected",
              "version": "12.5(1)SR3"
            },
            {
              "status": "affected",
              "version": "12.6(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.7(1)"
            },
            {
              "status": "affected",
              "version": "12.1(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.0(1)"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR2"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.0(1)SR3"
            },
            {
              "status": "affected",
              "version": "12.8(1)"
            },
            {
              "status": "affected",
              "version": "12.8(1)SR1"
            },
            {
              "status": "affected",
              "version": "12.8(1)SR2"
            },
            {
              "status": "affected",
              "version": "11.0(5)SR3"
            },
            {
              "status": "affected",
              "version": "11.0(6)"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR1"
            },
            {
              "status": "affected",
              "version": "11.0(6)SR2"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR6"
            },
            {
              "status": "affected",
              "version": "10.3(1)SR7"
            },
            {
              "status": "affected",
              "version": "12.7(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR1"
            },
            {
              "status": "affected",
              "version": "14.0(1)"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR2"
            },
            {
              "status": "affected",
              "version": "14.0(1)SR3"
            },
            {
              "status": "affected",
              "version": "14.1(1)"
            },
            {
              "status": "affected",
              "version": "14.1(1)SR1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-25T16:57:31.975Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
        "defects": [
          "CSCwc37223",
          "CSCwc37234"
        ],
        "discovery": "EXTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2023-20018",
    "datePublished": "2023-01-19T01:35:41.006Z",
    "dateReserved": "2022-10-27T18:47:50.308Z",
    "dateUpdated": "2024-08-02T08:57:35.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_7800_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"3603E753-AD60-4AF0-8FA8-A371260CB0C1\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_7800:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF03D5F2-0483-409B-90F0-A1430774A258\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"40DA5ABA-C866-4560-BE21-77B2643E8DB6\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D7260C17-7067-47AD-995F-366A5E8B10E7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"BABDE4DB-5BAA-448E-B009-D872FC515237\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE7AFFF0-5B21-400B-B923-E9B7FCCE08FA\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_7832_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"1CCABEA0-842F-449C-BE24-4B1BDD32F9BF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_7832:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32D8B3FD-3157-49D3-A4BA-D4FAAB1B6D4C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"D7667725-6B7B-4A04-890D-7487B58EC256\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"73CF8A50-11BD-4506-BF2A-CCA36BF59EFF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"702F4804-A675-4222-9AAE-2C5EF7D99001\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E52C420C-FD54-4BE4-8720-E05307D53520\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"02291A1F-29F1-4972-9CD9-E09116DF80C5\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1BBEA07-3154-4270-B865-D4AD26EB3B42\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"3F8D7A6A-1279-42A9-9FE9-1F6C8F765D17\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0CC3127-3152-4906-9FE0-BC6F21DCADAA\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"7A4D6EB2-404C-48CD-9F24-4845A95BA0AE\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36C99E0B-0383-4CB3-B325-EC0F3D57D39D\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"FAFDFD58-C58F-4967-9E85-6FAE66346E37\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EE56B858-B59D-4197-9B2A-33A03908B967\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8831_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"5334C11E-B07E-49A5-95CA-536630CEA788\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8831:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF13D70B-1F27-4B3F-83FD-EF9688F1D123\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8832_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"6AA83664-C710-4B45-B09F-3E29A2EB6638\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8832:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A5EA5C6B-243B-419A-9C60-1CDBD039C1D8\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"B1C26834-45D8-4B0D-A08C-BE0594EEAB4F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7944CC9C-AE08-4F30-AF65-134DADBD0FA1\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"33C51A07-3C77-4DDC-9C4F-E5E3BE55268E\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A313E64A-F43C-4FBA-A389-6171CBD709C0\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"2196ED9F-DA82-4D70-9BC2-97673A96B881\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8AF6DC5E-F582-445E-BF05-2D55A0954663\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"AFBDA235-4866-4058-82F5-27297E1923BF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"090EE553-01D5-45F0-87A4-E1167F46EB77\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"9249A092-250D-4BB8-AEEA-3B2190246223\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BB99B9AB-64B5-4989-9579-A1BB5D2D87EF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:ip_phones_8832_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"24A5CEB2-54CA-46D0-872D-90AAB39C9023\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:ip_phones_8832:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B980D4B-63D0-4786-AD62-FFE49FED33FD\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:unified_ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"18741BE2-B397-4F53-9845-4CB8AF7E65DD\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:unified_ip_phone_8851nr:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B021B260-CD3C-4EA5-9A2C-FE80B4ACA787\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:unified_ip_phone_8865nr_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"14.1\\\\(1\\\\)sr2\", \"matchCriteriaId\": \"2CEC15D2-210D-49B1-898D-591AA318CC82\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:unified_ip_phone_8865nr:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5EB7D543-296F-44AE-9335-BF3244F21E55\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.0\\\\(6\\\\)sr4\", \"matchCriteriaId\": \"503FE588-7543-45A1-A742-4657A5CC2DE8\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:wireless_ip_phone_8821:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F97DF354-7690-417E-B223-72C8BDA36DA7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.0\\\\(6\\\\)sr4\", \"matchCriteriaId\": \"09F02957-0FED-4D40-B42D-529C0FCEF252\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:cisco:wireless_ip_phone_8821-ex:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"26CAE4C7-EADB-41A9-BE48-1A4F3D8D3D7A\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\\r\\n\\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en la interfaz de administraci\\u00f3n basada en web de los tel\\u00e9fonos Cisco IP Phone de las series 7800 y 8800 podr\\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\\u00f3n en un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\\u00f3n insuficiente de la entrada proporcionada por el usuario. Un atacante podr\\u00eda aprovechar esta vulnerabilidad enviando una solicitud manipulada a la interfaz de administraci\\u00f3n basada en web. Un exploit exitoso podr\\u00eda permitir al atacante acceder a ciertas partes de la interfaz web que normalmente requerir\\u00edan autenticaci\\u00f3n.\"}]",
      "id": "CVE-2023-20018",
      "lastModified": "2024-11-21T07:40:21.247",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 4.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 2.5}]}",
      "published": "2023-01-20T07:15:13.633",
      "references": "[{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-288\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-20018\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2023-01-20T07:15:13.633\",\"lastModified\":\"2024-11-21T07:40:21.247\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\\r\\n\\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos Cisco IP Phone de las series 7800 y 8800 podr\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\u00f3n en un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando una solicitud manipulada a la interfaz de administraci\u00f3n basada en web. Un exploit exitoso podr\u00eda permitir al atacante acceder a ciertas partes de la interfaz web que normalmente requerir\u00edan autenticaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-288\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_7800_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"3603E753-AD60-4AF0-8FA8-A371260CB0C1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_7800:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF03D5F2-0483-409B-90F0-A1430774A258\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"40DA5ABA-C866-4560-BE21-77B2643E8DB6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7260C17-7067-47AD-995F-366A5E8B10E7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"BABDE4DB-5BAA-448E-B009-D872FC515237\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE7AFFF0-5B21-400B-B923-E9B7FCCE08FA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_7832_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"1CCABEA0-842F-449C-BE24-4B1BDD32F9BF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_7832:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32D8B3FD-3157-49D3-A4BA-D4FAAB1B6D4C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"D7667725-6B7B-4A04-890D-7487B58EC256\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73CF8A50-11BD-4506-BF2A-CCA36BF59EFF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"702F4804-A675-4222-9AAE-2C5EF7D99001\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E52C420C-FD54-4BE4-8720-E05307D53520\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"02291A1F-29F1-4972-9CD9-E09116DF80C5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1BBEA07-3154-4270-B865-D4AD26EB3B42\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"3F8D7A6A-1279-42A9-9FE9-1F6C8F765D17\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0CC3127-3152-4906-9FE0-BC6F21DCADAA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"7A4D6EB2-404C-48CD-9F24-4845A95BA0AE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36C99E0B-0383-4CB3-B325-EC0F3D57D39D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"FAFDFD58-C58F-4967-9E85-6FAE66346E37\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE56B858-B59D-4197-9B2A-33A03908B967\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8831_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"5334C11E-B07E-49A5-95CA-536630CEA788\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8831:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF13D70B-1F27-4B3F-83FD-EF9688F1D123\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8832_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"6AA83664-C710-4B45-B09F-3E29A2EB6638\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8832:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5EA5C6B-243B-419A-9C60-1CDBD039C1D8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"B1C26834-45D8-4B0D-A08C-BE0594EEAB4F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7944CC9C-AE08-4F30-AF65-134DADBD0FA1\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"33C51A07-3C77-4DDC-9C4F-E5E3BE55268E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A313E64A-F43C-4FBA-A389-6171CBD709C0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"2196ED9F-DA82-4D70-9BC2-97673A96B881\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF6DC5E-F582-445E-BF05-2D55A0954663\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"AFBDA235-4866-4058-82F5-27297E1923BF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"090EE553-01D5-45F0-87A4-E1167F46EB77\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"9249A092-250D-4BB8-AEEA-3B2190246223\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB99B9AB-64B5-4989-9579-A1BB5D2D87EF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ip_phones_8832_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"24A5CEB2-54CA-46D0-872D-90AAB39C9023\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:ip_phones_8832:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B980D4B-63D0-4786-AD62-FFE49FED33FD\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:unified_ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"18741BE2-B397-4F53-9845-4CB8AF7E65DD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:unified_ip_phone_8851nr:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B021B260-CD3C-4EA5-9A2C-FE80B4ACA787\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:unified_ip_phone_8865nr_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.1\\\\(1\\\\)sr2\",\"matchCriteriaId\":\"2CEC15D2-210D-49B1-898D-591AA318CC82\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:unified_ip_phone_8865nr:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EB7D543-296F-44AE-9335-BF3244F21E55\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.0\\\\(6\\\\)sr4\",\"matchCriteriaId\":\"503FE588-7543-45A1-A742-4657A5CC2DE8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:wireless_ip_phone_8821:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F97DF354-7690-417E-B223-72C8BDA36DA7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.0\\\\(6\\\\)sr4\",\"matchCriteriaId\":\"09F02957-0FED-4D40-B42D-529C0FCEF252\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:wireless_ip_phone_8821-ex:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26CAE4C7-EADB-41A9-BE48-1A4F3D8D3D7A\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

CISCO-SA-IP-PHONE-AUTH-BYPASS-PSQXZRPR

Vulnerability from csaf_cisco - Published: 2023-01-11 16:00 - Updated: 2023-01-11 16:00

Summary

Cisco IP Phone 7800 and 8800 Series Web Management Interface Authentication Bypass Vulnerability

Notes

Summary

Vulnerable Products

This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco SIP Software: IP Phone 7800 Series IP Phone 8800 Series For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: IP Phone 7800 Series with Multiplatform Software IP Phone 8800 Series with Multiplatform Software

Workarounds

There are no workarounds that address this vulnerability.

Fixed Software

Cisco has released free software updates ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu"] that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html ["https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"] Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page ["https://www.cisco.com/c/en/us/support/index.html"] on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page ["https://www.cisco.com/go/psirt"], to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"] Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases In the following table(s), the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] as indicated in this section. IP Phone 7800 and 8800 Series (Except Wireless IP Phone 8821) Cisco SIP Software Release First Fixed Release Earlier than 14.1(1)SR2 14.1(1)SR2 Wireless IP Phone 8821 Cisco SIP Software Release First Fixed Release Earlier than 11.0(6)SR4 11.0(6)SR4 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Vulnerability Policy

To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

Cisco would like to thank the UK National Cyber Security Centre (NCSC) for reporting this vulnerability.

Legal Disclaimer

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank the UK National Cyber Security Centre (NCSC) for reporting this vulnerability."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco SIP Software:\r\n\r\nIP Phone 7800 Series\r\nIP Phone 8800 Series\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nIP Phone 7800 Series with Multiplatform Software\r\nIP Phone 8800 Series with Multiplatform Software",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address this vulnerability.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco has released free software updates [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu\"] that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.\r\n\r\nCustomers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\r\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\r\n\r\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\r\n\r\nThe Cisco Support and Downloads page [\"https://www.cisco.com/c/en/us/support/index.html\"] on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n  Customers Without Service Contracts\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\r\n\r\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n      Fixed Releases\r\nIn the following table(s), the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] as indicated in this section.\r\n\r\nIP Phone 7800 and 8800 Series (Except Wireless IP Phone 8821)\r\n           Cisco SIP Software Release  First Fixed Release          Earlier than 14.1(1)SR2  14.1(1)SR2\r\nWireless IP Phone 8821\r\n           Cisco SIP Software Release  First Fixed Release           Earlier than 11.0(6)SR4  11.0(6)SR4\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank the UK National Cyber Security Centre (NCSC) for reporting this vulnerability.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco IP Phone 7800 and 8800 Series Web Management Interface Authentication Bypass Vulnerability",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "free software updates",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html",
        "url": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads page",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      }
    ],
    "title": "Cisco IP Phone 7800 and 8800 Series Web Management Interface Authentication Bypass Vulnerability",
    "tracking": {
      "current_release_date": "2023-01-11T16:00:00+00:00",
      "generator": {
        "date": "2024-05-10T23:21:08+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
      "initial_release_date": "2023-01-11T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2023-01-11T15:47:31+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Session Initiation Protocol (SIP) Software",
            "product": {
              "name": "Cisco Session Initiation Protocol (SIP) Software ",
              "product_id": "CSAFPID-277608"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20018",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwc37223"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwc37234"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-277608"
        ]
      },
      "release_date": "2023-01-11T16:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-277608"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-277608"
          ]
        }
      ],
      "title": "Cisco IP Phone 7800 and 8800 Series Authentication Bypass Vulnerability"
    }
  ]
}

VAR-202301-0952

Vulnerability from variot - Updated: 2024-01-29 19:37

A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202301-0952",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ip phone 7811",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8851",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8845",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 7861",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8811",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8821-ex",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "wireless ip phone 8821",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "11.0\\(6\\)sr4"
      },
      {
        "model": "unified ip phone 8865nr",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 7841",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "unified ip phone 8851nr",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 7821",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8841",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8865",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8861",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8800",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phones 8832",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 7800",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8821",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 8832",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 7832",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "wireless ip phone 8821-ex",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "11.0\\(6\\)sr4"
      },
      {
        "model": "ip phone 8831",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.1\\(1\\)sr2"
      },
      {
        "model": "ip phone 7821",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 7841",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 8811",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 7811",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 8821-ex",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 7832",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 8800",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 8821",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "ip phone 7861",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "cisco ip phone 7800 \u30b7\u30ea\u30fc\u30ba",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_7800_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_7800:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_7832_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_7832:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8831_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8831:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8832_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8832:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ip_phones_8832_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:ip_phones_8832:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:unified_ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:unified_ip_phone_8851nr:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:unified_ip_phone_8865nr_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:unified_ip_phone_8865nr:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "11.0\\(6\\)sr4",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:wireless_ip_phone_8821:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "11.0\\(6\\)sr4",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:wireless_ip_phone_8821-ex:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "cve": "CVE-2023-20018",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 3.9,
            "impactScore": 2.5,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "ykramarz@cisco.com",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 3.9,
            "impactScore": 4.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2023-20018",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2023-20018",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "ykramarz@cisco.com",
            "id": "CVE-2023-20018",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202301-1004",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. \r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-20018"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-20018",
        "trust": 3.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.0179",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-20018",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "id": "VAR-202301-0952",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.37675563
  },
  "last_update_date": "2024-01-29T19:37:29.328000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
        "trust": 0.8,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ip-phone-auth-bypass-psqxzrpr"
      },
      {
        "title": "Cisco: Cisco IP Phone 7800 and 8800 Series Web Management Interface Authentication Bypass Vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-ip-phone-auth-bypass-psqxzrpr"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-863",
        "trust": 1.0
      },
      {
        "problemtype": "Illegal authentication (CWE-863) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ip-phone-auth-bypass-psqxzrpr"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-20018"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.0179"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2023-20018/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-01-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-20018"
      },
      {
        "date": "2023-07-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "date": "2023-01-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      },
      {
        "date": "2023-01-20T07:15:13.633000",
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-01-20T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-20018"
      },
      {
        "date": "2023-07-05T07:48:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      },
      {
        "date": "2023-02-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      },
      {
        "date": "2024-01-25T17:15:25.060000",
        "db": "NVD",
        "id": "CVE-2023-20018"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco\u00a0IP\u00a0Phone\u00a07800\u00a0 and \u00a08800\u00a0 Fraudulent Authentication Vulnerability in Series",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-002345"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202301-1004"
      }
    ],
    "trust": 0.6
  }
}

CERTFR-2023-AVI-0026

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Cisco	N/A	Cisco BroadWorks Xtended Services Platform version 22.0 (Cisco recommande de migrer en version 23 avec les derniers correctifs de sécurité)
Cisco	N/A	Cisco BroadWorks Xtended Services Platform version 23.0 sans les correctifs de sécurité AP.xsp.23.0.1075.ap384245 et AP.platform.23.0.1075.ap384245
Cisco	N/A	Cisco SIP sur les téléphones IP sans-fil 8821 versions antérieures à 11.0(6)SR4
Cisco	N/A	Cisco Industrial Network Director (IND) versions antérieures à 1.7.0
Cisco	N/A	Cisco SIP sur les téléphones IP des séries 7800 et 8800 versions antérieures à 14.1(1)SR2
Cisco	Small Business	Routeurs Cisco Small Business RV016, RV042, RV042G et RV082 (Cisco indique que ces routeurs sont en fin de vie)
Cisco	N/A	Cisco BroadWorks Application Delivery Platform Device Management versions 22.0 sans les correctifs de sécurité ADP_Rel_2022.11_1.273 et dms_2022.11_1.273

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-ip-phone-auth-bypass-pSqxZRPR du 11 janvier 2023	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-sbr042-multi-vuln-ej76Pke5 du 11 janvier 2023	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-ind-fZyVjJtG du 11 janvier 2023	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-bw-dos-HpkeYzp du 11 janvier 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco BroadWorks Xtended Services Platform version 22.0 (Cisco recommande de migrer en version 23 avec les derniers correctifs de s\u00e9curit\u00e9)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco BroadWorks Xtended Services Platform version 23.0 sans les correctifs de s\u00e9curit\u00e9 AP.xsp.23.0.1075.ap384245 et AP.platform.23.0.1075.ap384245",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SIP sur les t\u00e9l\u00e9phones IP sans-fil 8821 versions ant\u00e9rieures \u00e0 11.0(6)SR4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Industrial Network Director (IND) versions ant\u00e9rieures \u00e0 1.7.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SIP sur les t\u00e9l\u00e9phones IP des s\u00e9ries 7800 et 8800 versions ant\u00e9rieures \u00e0 14.1(1)SR2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Routeurs Cisco Small Business RV016, RV042, RV042G et RV082 (Cisco indique que ces routeurs sont en fin de vie)",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco BroadWorks Application Delivery Platform Device Management versions 22.0 sans les correctifs de s\u00e9curit\u00e9 ADP_Rel_2022.11_1.273 et dms_2022.11_1.273",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-20037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20037"
    },
    {
      "name": "CVE-2023-20018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20018"
    },
    {
      "name": "CVE-2023-20038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20038"
    },
    {
      "name": "CVE-2023-20020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20020"
    },
    {
      "name": "CVE-2023-20025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20025"
    },
    {
      "name": "CVE-2023-20026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20026"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0026",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-01-12T00:00:00.000000"
    },
    {
      "description": "Correction coquille.",
      "revision_date": "2023-01-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ip-phone-auth-bypass-pSqxZRPR du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sbr042-multi-vuln-ej76Pke5 du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ind-fZyVjJtG du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-bw-dos-HpkeYzp du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-dos-HpkeYzp"
    }
  ]
}

CERTFR-2023-AVI-0026

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Cisco	N/A	Cisco BroadWorks Xtended Services Platform version 22.0 (Cisco recommande de migrer en version 23 avec les derniers correctifs de sécurité)
Cisco	N/A	Cisco BroadWorks Xtended Services Platform version 23.0 sans les correctifs de sécurité AP.xsp.23.0.1075.ap384245 et AP.platform.23.0.1075.ap384245
Cisco	N/A	Cisco SIP sur les téléphones IP sans-fil 8821 versions antérieures à 11.0(6)SR4
Cisco	N/A	Cisco Industrial Network Director (IND) versions antérieures à 1.7.0
Cisco	N/A	Cisco SIP sur les téléphones IP des séries 7800 et 8800 versions antérieures à 14.1(1)SR2
Cisco	Small Business	Routeurs Cisco Small Business RV016, RV042, RV042G et RV082 (Cisco indique que ces routeurs sont en fin de vie)
Cisco	N/A	Cisco BroadWorks Application Delivery Platform Device Management versions 22.0 sans les correctifs de sécurité ADP_Rel_2022.11_1.273 et dms_2022.11_1.273

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-ip-phone-auth-bypass-pSqxZRPR du 11 janvier 2023	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-sbr042-multi-vuln-ej76Pke5 du 11 janvier 2023	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-ind-fZyVjJtG du 11 janvier 2023	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-bw-dos-HpkeYzp du 11 janvier 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco BroadWorks Xtended Services Platform version 22.0 (Cisco recommande de migrer en version 23 avec les derniers correctifs de s\u00e9curit\u00e9)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco BroadWorks Xtended Services Platform version 23.0 sans les correctifs de s\u00e9curit\u00e9 AP.xsp.23.0.1075.ap384245 et AP.platform.23.0.1075.ap384245",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SIP sur les t\u00e9l\u00e9phones IP sans-fil 8821 versions ant\u00e9rieures \u00e0 11.0(6)SR4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Industrial Network Director (IND) versions ant\u00e9rieures \u00e0 1.7.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco SIP sur les t\u00e9l\u00e9phones IP des s\u00e9ries 7800 et 8800 versions ant\u00e9rieures \u00e0 14.1(1)SR2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Routeurs Cisco Small Business RV016, RV042, RV042G et RV082 (Cisco indique que ces routeurs sont en fin de vie)",
      "product": {
        "name": "Small Business",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco BroadWorks Application Delivery Platform Device Management versions 22.0 sans les correctifs de s\u00e9curit\u00e9 ADP_Rel_2022.11_1.273 et dms_2022.11_1.273",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-20037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20037"
    },
    {
      "name": "CVE-2023-20018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20018"
    },
    {
      "name": "CVE-2023-20038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20038"
    },
    {
      "name": "CVE-2023-20020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20020"
    },
    {
      "name": "CVE-2023-20025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20025"
    },
    {
      "name": "CVE-2023-20026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20026"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0026",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-01-12T00:00:00.000000"
    },
    {
      "description": "Correction coquille.",
      "revision_date": "2023-01-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ip-phone-auth-bypass-pSqxZRPR du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sbr042-multi-vuln-ej76Pke5 du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ind-fZyVjJtG du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-bw-dos-HpkeYzp du 11 janvier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-dos-HpkeYzp"
    }
  ]
}

GSD-2023-20018

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-20018

Aliases

CVE-2023-20018

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-20018",
    "id": "GSD-2023-20018"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-20018"
      ],
      "details": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.",
      "id": "GSD-2023-20018",
      "modified": "2023-12-13T01:20:28.780886Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@cisco.com",
        "ID": "CVE-2023-20018",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Cisco Session Initiation Protocol (SIP) Software",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "9.3(4) 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "9.3(4)SR3 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "9.3(4)SR1 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "9.3(4)SR2 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(2)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.5(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(5)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(2)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.7(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(4)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(0.7) MPP"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(4)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)SR5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)SR6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(4)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(1) MPP"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(4)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)SR4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(5)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(5)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(3)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(2)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.5(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11-0-1MSR1-1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.4(1) 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1.11) 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.2(2)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.2(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.1(1.9)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.1(1)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.2(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.1(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.4(1)SR2 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR4b"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1.9) 3rd Party"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(2)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.6(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.1(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5(1)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5(1)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.6(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.7(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.1(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0(1)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0(1)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.8(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.8(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.8(1)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(5)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(6)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(6)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0(6)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "10.3(1)SR7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.7(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0(1)SR1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0(1)SR2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0(1)SR3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.1(1)"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.1(1)SR1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Cisco"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication."
          }
        ]
      },
      "exploit": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-288",
                "lang": "eng",
                "value": "Authentication Bypass Using an Alternate Path or Channel"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
            "refsource": "MISC",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
          }
        ]
      },
      "source": {
        "advisory": "cisco-sa-ip-phone-auth-bypass-pSqxZRPR",
        "defects": [
          "CSCwc37223",
          "CSCwc37234"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_7800_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3603E753-AD60-4AF0-8FA8-A371260CB0C1",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_7800:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF03D5F2-0483-409B-90F0-A1430774A258",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40DA5ABA-C866-4560-BE21-77B2643E8DB6",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7260C17-7067-47AD-995F-366A5E8B10E7",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BABDE4DB-5BAA-448E-B009-D872FC515237",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AE7AFFF0-5B21-400B-B923-E9B7FCCE08FA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_7832_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1CCABEA0-842F-449C-BE24-4B1BDD32F9BF",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_7832:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "32D8B3FD-3157-49D3-A4BA-D4FAAB1B6D4C",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7667725-6B7B-4A04-890D-7487B58EC256",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "73CF8A50-11BD-4506-BF2A-CCA36BF59EFF",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "702F4804-A675-4222-9AAE-2C5EF7D99001",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E52C420C-FD54-4BE4-8720-E05307D53520",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "02291A1F-29F1-4972-9CD9-E09116DF80C5",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C1BBEA07-3154-4270-B865-D4AD26EB3B42",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3F8D7A6A-1279-42A9-9FE9-1F6C8F765D17",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0CC3127-3152-4906-9FE0-BC6F21DCADAA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7A4D6EB2-404C-48CD-9F24-4845A95BA0AE",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36C99E0B-0383-4CB3-B325-EC0F3D57D39D",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FAFDFD58-C58F-4967-9E85-6FAE66346E37",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EE56B858-B59D-4197-9B2A-33A03908B967",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8831_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5334C11E-B07E-49A5-95CA-536630CEA788",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8831:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF13D70B-1F27-4B3F-83FD-EF9688F1D123",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8832_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6AA83664-C710-4B45-B09F-3E29A2EB6638",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8832:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5EA5C6B-243B-419A-9C60-1CDBD039C1D8",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1C26834-45D8-4B0D-A08C-BE0594EEAB4F",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7944CC9C-AE08-4F30-AF65-134DADBD0FA1",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33C51A07-3C77-4DDC-9C4F-E5E3BE55268E",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A313E64A-F43C-4FBA-A389-6171CBD709C0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2196ED9F-DA82-4D70-9BC2-97673A96B881",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8AF6DC5E-F582-445E-BF05-2D55A0954663",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFBDA235-4866-4058-82F5-27297E1923BF",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "090EE553-01D5-45F0-87A4-E1167F46EB77",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9249A092-250D-4BB8-AEEA-3B2190246223",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB99B9AB-64B5-4989-9579-A1BB5D2D87EF",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:ip_phones_8832_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "24A5CEB2-54CA-46D0-872D-90AAB39C9023",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:ip_phones_8832:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B980D4B-63D0-4786-AD62-FFE49FED33FD",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:unified_ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18741BE2-B397-4F53-9845-4CB8AF7E65DD",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:unified_ip_phone_8851nr:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B021B260-CD3C-4EA5-9A2C-FE80B4ACA787",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:unified_ip_phone_8865nr_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2CEC15D2-210D-49B1-898D-591AA318CC82",
                    "versionEndExcluding": "14.1\\(1\\)sr2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:unified_ip_phone_8865nr:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5EB7D543-296F-44AE-9335-BF3244F21E55",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "503FE588-7543-45A1-A742-4657A5CC2DE8",
                    "versionEndExcluding": "11.0\\(6\\)sr4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:wireless_ip_phone_8821:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F97DF354-7690-417E-B223-72C8BDA36DA7",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09F02957-0FED-4D40-B42D-529C0FCEF252",
                    "versionEndExcluding": "11.0\\(6\\)sr4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:cisco:wireless_ip_phone_8821-ex:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26CAE4C7-EADB-41A9-BE48-1A4F3D8D3D7A",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication."
          }
        ],
        "id": "CVE-2023-20018",
        "lastModified": "2024-01-25T17:15:25.060",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.7,
              "source": "ykramarz@cisco.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-01-20T07:15:13.633",
        "references": [
          {
            "source": "ykramarz@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
          }
        ],
        "sourceIdentifier": "ykramarz@cisco.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-288"
              }
            ],
            "source": "ykramarz@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2023-20018

Vulnerability from fkie_nvd - Published: 2023-01-20 07:15 - Updated: 2024-11-21 07:40

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR	Vendor Advisory

Impacted products

Vendor	Product	Version
cisco	ip_phone_7800_firmware	*
cisco	ip_phone_7800	-
cisco	ip_phone_7811_firmware	*
cisco	ip_phone_7811	-
cisco	ip_phone_7821_firmware	*
cisco	ip_phone_7821	-
cisco	ip_phone_7832_firmware	*
cisco	ip_phone_7832	-
cisco	ip_phone_7841_firmware	*
cisco	ip_phone_7841	-
cisco	ip_phone_7861_firmware	*
cisco	ip_phone_7861	-
cisco	ip_phone_8800_firmware	*
cisco	ip_phone_8800	-
cisco	ip_phone_8811_firmware	*
cisco	ip_phone_8811	-
cisco	ip_phone_8821_firmware	*
cisco	ip_phone_8821	-
cisco	ip_phone_8821-ex_firmware	*
cisco	ip_phone_8821-ex	-
cisco	ip_phone_8831_firmware	*
cisco	ip_phone_8831	-
cisco	ip_phone_8832_firmware	*
cisco	ip_phone_8832	-
cisco	ip_phone_8841_firmware	*
cisco	ip_phone_8841	-
cisco	ip_phone_8845_firmware	*
cisco	ip_phone_8845	-
cisco	ip_phone_8851_firmware	*
cisco	ip_phone_8851	-
cisco	ip_phone_8861_firmware	*
cisco	ip_phone_8861	-
cisco	ip_phone_8865_firmware	*
cisco	ip_phone_8865	-
cisco	ip_phones_8832_firmware	*
cisco	ip_phones_8832	-
cisco	unified_ip_phone_8851nr_firmware	*
cisco	unified_ip_phone_8851nr	-
cisco	unified_ip_phone_8865nr_firmware	*
cisco	unified_ip_phone_8865nr	-
cisco	wireless_ip_phone_8821_firmware	*
cisco	wireless_ip_phone_8821	-
cisco	wireless_ip_phone_8821-ex_firmware	*
cisco	wireless_ip_phone_8821-ex	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_7800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3603E753-AD60-4AF0-8FA8-A371260CB0C1",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_7800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF03D5F2-0483-409B-90F0-A1430774A258",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40DA5ABA-C866-4560-BE21-77B2643E8DB6",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7260C17-7067-47AD-995F-366A5E8B10E7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BABDE4DB-5BAA-448E-B009-D872FC515237",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE7AFFF0-5B21-400B-B923-E9B7FCCE08FA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_7832_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CCABEA0-842F-449C-BE24-4B1BDD32F9BF",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_7832:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "32D8B3FD-3157-49D3-A4BA-D4FAAB1B6D4C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7667725-6B7B-4A04-890D-7487B58EC256",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73CF8A50-11BD-4506-BF2A-CCA36BF59EFF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "702F4804-A675-4222-9AAE-2C5EF7D99001",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E52C420C-FD54-4BE4-8720-E05307D53520",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02291A1F-29F1-4972-9CD9-E09116DF80C5",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1BBEA07-3154-4270-B865-D4AD26EB3B42",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F8D7A6A-1279-42A9-9FE9-1F6C8F765D17",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0CC3127-3152-4906-9FE0-BC6F21DCADAA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A4D6EB2-404C-48CD-9F24-4845A95BA0AE",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "36C99E0B-0383-4CB3-B325-EC0F3D57D39D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAFDFD58-C58F-4967-9E85-6FAE66346E37",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE56B858-B59D-4197-9B2A-33A03908B967",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8831_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5334C11E-B07E-49A5-95CA-536630CEA788",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8831:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF13D70B-1F27-4B3F-83FD-EF9688F1D123",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8832_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AA83664-C710-4B45-B09F-3E29A2EB6638",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8832:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5EA5C6B-243B-419A-9C60-1CDBD039C1D8",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1C26834-45D8-4B0D-A08C-BE0594EEAB4F",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7944CC9C-AE08-4F30-AF65-134DADBD0FA1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33C51A07-3C77-4DDC-9C4F-E5E3BE55268E",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A313E64A-F43C-4FBA-A389-6171CBD709C0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2196ED9F-DA82-4D70-9BC2-97673A96B881",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AF6DC5E-F582-445E-BF05-2D55A0954663",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFBDA235-4866-4058-82F5-27297E1923BF",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "090EE553-01D5-45F0-87A4-E1167F46EB77",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9249A092-250D-4BB8-AEEA-3B2190246223",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB99B9AB-64B5-4989-9579-A1BB5D2D87EF",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phones_8832_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "24A5CEB2-54CA-46D0-872D-90AAB39C9023",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:ip_phones_8832:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B980D4B-63D0-4786-AD62-FFE49FED33FD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:unified_ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18741BE2-B397-4F53-9845-4CB8AF7E65DD",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:unified_ip_phone_8851nr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B021B260-CD3C-4EA5-9A2C-FE80B4ACA787",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:unified_ip_phone_8865nr_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CEC15D2-210D-49B1-898D-591AA318CC82",
              "versionEndExcluding": "14.1\\(1\\)sr2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:unified_ip_phone_8865nr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EB7D543-296F-44AE-9335-BF3244F21E55",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "503FE588-7543-45A1-A742-4657A5CC2DE8",
              "versionEndExcluding": "11.0\\(6\\)sr4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wireless_ip_phone_8821:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F97DF354-7690-417E-B223-72C8BDA36DA7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "09F02957-0FED-4D40-B42D-529C0FCEF252",
              "versionEndExcluding": "11.0\\(6\\)sr4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wireless_ip_phone_8821-ex:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "26CAE4C7-EADB-41A9-BE48-1A4F3D8D3D7A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device.\r\n\r This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos Cisco IP Phone de las series 7800 y 8800 podr\u00eda permitir que un atacante remoto no autenticado omita la autenticaci\u00f3n en un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando una solicitud manipulada a la interfaz de administraci\u00f3n basada en web. Un exploit exitoso podr\u00eda permitir al atacante acceder a ciertas partes de la interfaz web que normalmente requerir\u00edan autenticaci\u00f3n."
    }
  ],
  "id": "CVE-2023-20018",
  "lastModified": "2024-11-21T07:40:21.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-01-20T07:15:13.633",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JC6W-V2GH-GQX3

Vulnerability from github – Published: 2023-01-20 09:30 – Updated: 2023-02-01 03:30

Details

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-20018"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-20T07:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.",
  "id": "GHSA-jc6w-v2gh-gqx3",
  "modified": "2023-02-01T03:30:29Z",
  "published": "2023-01-20T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20018"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-20018 (GCVE-0-2023-20018)

CISCO-SA-IP-PHONE-AUTH-BYPASS-PSQXZRPR

VAR-202301-0952

CERTFR-2023-AVI-0026

Solution

CERTFR-2023-AVI-0026

Solution

GSD-2023-20018

FKIE_CVE-2023-20018

GHSA-JC6W-V2GH-GQX3

Tags

Sightings

Nomenclature