Cisco Unified IP Phone Unified Communications Manager weak prng

Summaryinfo

A vulnerability identified as problematic has been detected in Cisco Unified IP Phone. Impacted is an unknown function of the component Unified Communications Manager. This manipulation causes weak prng. This vulnerability is handled as CVE-2022-20817. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Cisco Unified IP Phone (IP Phone Software) (affected version not known). Affected by this vulnerability is some unknown functionality of the component Unified Communications Manager. The manipulation with an unknown input leads to a weak prng vulnerability. The CWE definition for the vulnerability is CWE-338. The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.

The weakness was released 06/16/2022 as cisco-sa-cp6901-dup-cert-82jdJGe4. The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2022-20817 since 11/02/2021. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• IP Phone Software

Vendor

• Cisco

Name

• Unified IP Phone

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion