Strix
26.1K

CVE-2020-3360

MEDIUMCVSS 5.3/10EPSS 1.26%

Last modified

CVE-2020-3360 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. EPSS estimates a 1.26% chance of exploitation in the next 30 days.

Description

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
1.26%

66.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoUnified Ip Phone 6901 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 6961 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 6945 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 6941 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 6921 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 6911 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7832 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7861 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7841 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7821 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7811 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7937g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7975g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7965g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7962g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7961g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7960g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7945g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7942g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7941g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7940g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7931g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7911g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 7906g Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8811 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8841 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8845 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8851 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8851nr Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8861 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8865 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8865nr Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8961 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8945 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 8941 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 9971 Firmware<= 12.8\(1\)
CiscoUnified Ip Phone 9951 Firmware<= 12.8\(1\)

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-3360?
A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.
How severe is CVE-2020-3360?
CVE-2020-3360 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 1.26% probability of exploitation in the next 30 days.
How do I fix CVE-2020-3360?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-3360?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST