20200415 Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

http://packetstormsecurity.com/files/157265/Cisco-IP-Phone-11.7-Denial-Of-Service.html

A denial of service (DoS) vulnerability and remote code execution (RCE) exists in Cisco IP Phones due to a lack of proper input validation of HTTP requests. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

CVE-2020-3161

critical

Tenable Plugins

critical