CVE-2023-20018
Last modified
CVE-2023-20018 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. EPSS estimates a 0.61% chance of exploitation in the next 30 days.
Description
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ip Phone 7800 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 7811 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 7821 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 7832 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 7841 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 7861 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8800 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8811 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8821 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8821-Ex Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8831 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8832 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8841 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8845 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8851 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8861 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phone 8865 Firmware | < 14.1\(1\)sr2 |
| Cisco | Ip Phones 8832 Firmware | < 14.1\(1\)sr2 |
| Cisco | Unified Ip Phone 8851nr Firmware | < 14.1\(1\)sr2 |
| Cisco | Unified Ip Phone 8865nr Firmware | < 14.1\(1\)sr2 |
| Cisco | Wireless Ip Phone 8821 Firmware | < 11.0\(6\)sr4 |
| Cisco | Wireless Ip Phone 8821-Ex Firmware | < 11.0\(6\)sr4 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-20018?
How severe is CVE-2023-20018?
How do I fix CVE-2023-20018?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-20012A vulnerability in the CLI console login authentication of C…4.6
- CVE-2023-20013Multiple vulnerabilities in Cisco Intersight Private Virtual…9.1
- CVE-2023-20014A vulnerability in the DNS functionality of Cisco Nexus Dash…7.5
- CVE-2023-20015A vulnerability in the CLI of Cisco Firepower 4100 Series, C…6.7
- CVE-2023-20016A vulnerability in the backup configuration feature of Cisco…6.5
- CVE-2023-20017Multiple vulnerabilities in Cisco Intersight Private Virtual…9.1
- CVE-2023-20019A vulnerability in the web-based management interface of Cis…6.1
- CVE-2023-2002A vulnerability was found in the HCI sockets implementation …6.8
- CVE-2023-20020A vulnerability in the Device Management Servlet application…8.6
- CVE-2023-20021Multiple vulnerabilities in specific Cisco Identity Services…6.7
- CVE-2023-20022Multiple vulnerabilities in specific Cisco Identity Services…6.7
- CVE-2023-20023Multiple vulnerabilities in specific Cisco Identity Services…6.7
Are you affected by CVE-2023-20018?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST