What is the CVSS score of CVE-2024-20445?

CVE-2024-20445 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Desk Phone 9841 Firmware CVE-2024-20445

MEDIUM

Information Exposure (CWE-200)

2024-11-06 psirt@cisco.com

Cisco Information Disclosure Desk Phone 9841 Firmware Desk Phone 9851 Firmware Desk Phone 9861 Firmware Desk Phone 9871 Firmware Ip Conference Phone 7832 Firmware Ip Conference Phone 8831 Firmware Ip Conference Phone 8832 Firmware Ip Phone 7811 Firmware Ip Phone 7821 Firmware Ip Phone 7841 Firmware Ip Phone 7861 Firmware Ip Phone 8811 Firmware Ip Phone 8841 Firmware Ip Phone 8845 Firmware Ip Phone 8851 Firmware Ip Phone 8851Nr Firmware Ip Phone 8861 Firmware Video Phone 8875 Firmware

5.3

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 06, 2024 - 17:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default.

AnalysisAI

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default. Affected products include: Cisco Desk Phone 9841 Firmware, Cisco Desk Phone 9851 Firmware, Cisco Desk Phone 9861 Firmware, Cisco Desk Phone 9871 Firmware, Cisco Ip Conference Phone 7832 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.