What’s Vulnerable › Vulnerabilities

CVE-2024-20376

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-01 · updated 2026-06-17
• Weakness: CWE-787

Description

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the affected device to reload.

Affected products

• Cisco Ip Phone 6821 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6841 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6851 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6861 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 6871 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7811 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7821 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7832 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7841 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 7861 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8811 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8832 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8841 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8845 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8851 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8861 With Multiplatform Firmware: through 12.0.4
• Cisco Ip Phone 8865 With Multiplatform Firmware: through 12.0.4
• Cisco Video Phone 8875 Firmware: before 2.3.1.0101 — fixed in 2.3.1.0101

How to fix

Upgrade to a fixed version: Cisco Video Phone 8875 Firmware 2.3.1.0101. Check the vendor advisory for mitigations.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS

Get alerted when CVE-2024-20376 or the next vulnerability affects your stack