Lucene search

[email protected]CVE-2022-20774

HistoryApr 06, 2022 - 7:15 p.m.

CVE-2022-20774

2022-04-0619:15:08

CWE-345

CWE-352

[email protected]

web.nvd.nist.gov

cisco

ip phone

csrf

vulnerability

web-based management

denial of service

cisco ip phone 6800

cisco ip phone 7800

cisco ip phone 8800

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.5%

JSON

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform configuration changes on the affected device, resulting in a denial of service (DoS) condition.

Affected configurations

NVD

Node

ciscoip_phone_6871_firmwareRange<11.3.5

AND

ciscoip_phone_6871Match-

Node

ciscoip_phone_6861_firmwareRange<11.3.5

AND

ciscoip_phone_6861Match-

Node

ciscoip_phone_6851_firmwareRange<11.3.5

AND

ciscoip_phone_6851Match-

Node

ciscoip_phone_6841_firmwareRange<11.3.5

AND

ciscoip_phone_6841Match-

Node

ciscoip_phone_6825_firmwareRange<11.3.5

AND

ciscoip_phone_6825Match-

Node

ciscoip_phone_7861_firmwareRange<11.3.5

AND

ciscoip_phone_7861Match-

Node

ciscoip_phone_7841_firmwareRange<11.3.5

AND

ciscoip_phone_7841Match-

Node

ciscoip_phone_7832Match-

AND

ciscoip_phone_7832_firmwareRange<11.3.5

Node

ciscoip_phone_7821Match-

AND

ciscoip_phone_7821_firmwareRange<11.3.5

Node

ciscoip_phone_7811Match-

AND

ciscoip_phone_7811_firmwareRange<11.3.5

Node

ciscoip_phone_8865Match-

AND

ciscoip_phone_8865_firmwareRange<11.3.5

Node

ciscoip_phone_8861Match-

AND

ciscoip_phone_8861_firmwareRange<11.3.5

Node

ciscoip_phone_8851Match-

AND

ciscoip_phone_8851_firmwareRange<11.3.5

Node

ciscoip_phone_8845Match-

AND

ciscoip_phone_8845_firmwareRange<11.3.5

Node

ciscoip_phone_8841Match-

AND

ciscoip_phone_8841_firmwareRange<11.3.5

Node

ciscoip_phone_8832Match-

AND

ciscoip_phone_8832_firmwareRange<11.3.5

Node

ciscoip_phone_8811Match-

AND

ciscoip_phone_8811_firmwareRange<11.3.5

CPENameOperatorVersion
cisco:ip_phone_6871_firmwarecisco ip phone 6871 firmwarelt11.3.5

CPE	Name	Operator	Version
cisco:ip_phone_6871_firmware	cisco ip phone 6871 firmware	lt	11.3.5

CNA Affected

[
  {
    "product": "Cisco IP Phone 7800 Series with Multiplatform Firmware ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-csrf-K56vXvVx

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.5%

JSON

Related for CVE-2022-20774

nvd1 cvelist1 prion1 nessus1 cisco1