CVE-2023-20221

State: Published
Severity: 6.5 Medium
Published: Aug 16, 2023
Updated: Aug 2, 2024
Reserved: Oct 27, 2022

Description

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform a factory reset of the affected device, resulting in a Denial of Service (DoS) condition.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	cisco

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
Cisco IP Phones with Multiplatform FirmwareCisco	11.3.1 MSR2-6Affected 11.3.1 MSR3-3Affected 11.3.2Affected 11.3.3Affected 11.3.4Affected 11.3.5Affected 11.3.3 MSR1Affected 11.3.6Affected 11-3-1MPPSR4UPGAffected 11.3.7Affected 11-3-1MSR2UPGAffected 11.3.6SR1Affected 11.3.7SR1Affected 11.3.7SR2Affected 11.0.0Affected 11.0.1Affected 11.0.1 MSR1-1Affected 11.0.2Affected 11.1.1Affected 11.1.1 MSR1-1Affected 11.1.1 MSR2-1Affected 11.1.2Affected 11.1.2 MSR1-1Affected 11.1.2 MSR3-1Affected 11.2.1Affected and 6 more versions
Cisco PhoneOSCisco	1.0.1Affected

Product

Versions

Cisco IP Phones with Multiplatform FirmwareCisco

11.3.1 MSR2-6Affected
11.3.1 MSR3-3Affected
11.3.2Affected
11.3.3Affected
11.3.4Affected
11.3.5Affected
11.3.3 MSR1Affected
11.3.6Affected
11-3-1MPPSR4UPGAffected
11.3.7Affected
11-3-1MSR2UPGAffected
11.3.6SR1Affected
11.3.7SR1Affected
11.3.7SR2Affected
11.0.0Affected
11.0.1Affected
11.0.1 MSR1-1Affected
11.0.2Affected
11.1.1Affected
11.1.1 MSR1-1Affected
11.1.1 MSR2-1Affected
11.1.2Affected
11.1.2 MSR1-1Affected
11.1.2 MSR3-1Affected
11.2.1Affected
and 6 more versions

Cisco PhoneOSCisco

1.0.1Affected

References

cisco-sa-ipphone-csrf-HOCmXW2c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.