What’s Vulnerable › Vulnerabilities

CVE-2024-20357

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-01 · updated 2026-06-17
• Weakness: CWE-787

Description

A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.

Affected products

• Cisco Ip Phone 6821 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6841 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6851 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6861 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6871 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7811 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7821 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7832 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7841 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7861 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8811 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8832 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8841 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8845 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8851 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8861 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8865 With Multiplatform Firmware: through 12.0.4
• Cisco Video Phone 8875 Firmware: before 2.3.1.0101 — fixed in 2.3.1.0101

How to fix

Upgrade to a fixed version: Cisco Video Phone 8875 Firmware 2.3.1.0101. Check the vendor advisory for mitigations.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS

Get alerted when CVE-2024-20357 or the next vulnerability affects your stack