Cisco IP Phone 7800/IP Phone 8800 Web-based Management Interface information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in Cisco IP Phone 7800 and IP Phone 8800. This issue affects some unknown processing of the component Web-based Management Interface. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2020-3360. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Cisco IP Phone 7800 and IP Phone 8800 (IP Phone Software) (the affected version unknown). Affected by this issue is an unknown part of the component Web-based Management Interface. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.

The weakness was presented 06/18/2020 as cisco-sa-phone-logs-2O7f7ExM as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2020-3360 since 12/12/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• IP Phone Software

Vendor

• Cisco

Name

• IP Phone 7800
• IP Phone 8800

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion