Black Arrow Cyber Advisory 03 March 2023 – Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web User Interface Vulnerabilities
Executive Summary
Multiple Vulnerabilities in the web-based management interface for the Cisco IP Phones: 6800, 7800, 7900, and 8800 have been identified. The vulnerabilities are tracked as CVE-2023-20078 and CVE-2023-20079.
What’s the risk to me or my business?
Successful exploitation of the vulnerabilities could allow an attacker to remotely execute code or cause a denial of service (DoS). The vulnerabilities are not dependent on each other and can therefore be executed without requiring the other one.
What can I do?
There are no workarounds, and it is recommended that the patches for the vulnerabilities released by CISCO are installed.
The following models and firmware versions are impacted:
· IP Phone 6800 Series with Multiplatform Firmware version earlier than 11.3.7SR1
· IP Phone 7800 Series with Multiplatform Firmware version earlier than 11.3.7SR1
· IP Phone 8800 Series with Multiplatform Firmware version earlier than 11.3.7SR1
Due to the following products having reached the end of life process, there is no patch available:
· Cisco Unified IP Phone 7900 Series
· Cisco Unified IP Conference Phone 8831
· Cisco Unified IP Conference Phone 8831 with Multiplatform Firmware
Further information on the vulnerabilities be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity