Cisco IP Phone Information Disclosure Vulnerability Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Type: Information Disclosure Vulnerability - Affected Products: Cisco 7800, 8800, and 9800 Series phones - Vulnerability Details: Due to improper storage of sensitive information in the SIP-based phone payload web UI, unauthorized attackers can access sensitive information on affected devices by browsing to the IP address of devices with web access enabled. 2. Affected Product List: - Desk Phone 9800 Series - IP Phone 7800 Series - IP Phone 8800 Series (excluding Cisco Wireless IP Phone 8821) - Video Phone 8875 3. Exploitation Mechanism: - Attackers can access sensitive information, including inbound and outbound call logs, by browsing to the IP address of devices that have web access enabled. 4. Solution: - Software Update: Cisco has released software updates to address this vulnerability. There is no workaround available for this vulnerability. - Web Access: Web access is disabled by default. If users can browse to the IP address, it indicates that web access has been enabled. 5. Affected Product Confirmation: - Cisco confirms that this vulnerability does not affect 7800 Series or 8800 Series phones running Cisco Multiplatform Firmware. 6. Workaround: - No workaround is available for this vulnerability. 7. Fixed Software: - When considering software upgrades, it is recommended to regularly review Cisco product security advisories to determine exposure and identify complete upgrade solutions. 8. Affected Versions: - Desk Phone 9800 Series: 3.1(1) and 3.1(1)SR1 - IP Phone 7800 and 8800 Series: 14.3 - Video Phone 8875: 2.3(1)SR1 and 3.2(1) 9. Disclaimer: - This document is provided "AS IS" without any warranties or guarantees, including but not limited to merchantability or fitness for a particular purpose. The risk of using this document or any materials linked from it is solely at the user’s own discretion. Cisco reserves the right to modify or update this document at any time. This information helps users understand the nature of the vulnerability, the affected products, available solutions, and how to identify and remediate the issue.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IP Phone Information Disclosure Vulnerability Advisory