Cisco IP Phone SIP Software Arbitrary File Write & Info Disclosure (CVE-2020-3537/3538)

Key Vulnerability Information Vulnerability Overview CVE ID: CVE-2020-3537, CVE-2020-3538 CVSS Score: 6.1 (Medium) Affected Products: Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, Video Phone 8875 with SIP Software Vulnerability Details CVE-2020-3537: Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, Video Phone 8875 with SIP Software Arbitrary File Write Vulnerability - Description: Attackers can send specially crafted requests to affected devices, leading to arbitrary file write. - Impact: May result in unauthorized information disclosure or remote code execution. CVE-2020-3538: Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, Video Phone 8875 with SIP Software Information Disclosure Vulnerability - Description: Attackers can send specially crafted requests to affected devices, leading to sensitive information disclosure. - Impact: May result in unauthorized information disclosure. Affected Versions Cisco Desk Phone 9800 Series: - SIP Software: Version 14.1(1) and earlier IP Phone 7800 and 8800 Series: - SIP Software: Version 14.1(1) and earlier Video Phone 8875: - SIP Software: Version 14.1(1) and earlier Fixed Versions Cisco Desk Phone 9800 Series: - SIP Software: Version 14.1(2) and later IP Phone 7800 and 8800 Series: - SIP Software: Version 14.1(2) and later Video Phone 8875: - SIP Software: Version 14.1(2) and later Exploitation Mechanism CVE-2020-3537: Attackers exploit a vulnerability in the software by sending specially crafted requests to perform arbitrary file writes. CVE-2020-3538: Attackers exploit a vulnerability in the software by sending specially crafted requests to disclose sensitive information. Mitigation Upgrade to the fixed version of SIP Software to resolve the vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco IP Phone SIP Software Arbitrary File Write & Info Disclosure (CVE-2020-3537/3538)