Auth bypass in Cisco Session Initiation Protocol (Sip) Software
CVE-2023-20018
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficien…
EPSS: 0.006 (45.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
Affected products
- Cisco Session Initiation Protocol (Sip) Software — versions 9.3(4) 3rd Party, 9.3(4)SR3 3rd Party, 9.3(4)SR1 3rd Party
- Cisco Ip_phone_7800
- Cisco Ip_phone_7800_firmware
- Cisco Ip_phone_7811
- Cisco Ip_phone_7811_firmware
- Cisco Ip_phone_7821
- Cisco Ip_phone_7821_firmware
- Cisco Ip_phone_7832
- Cisco Ip_phone_7832_firmware
- Cisco Ip_phone_7841
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-20018?
- CVE-2023-20018 is a high-severity vulnerability in Cisco Session Initiation Protocol (Sip) Software, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.6/10. Published 2023-01-20.
- How severe is CVE-2023-20018?
- High severity. CVSS v3 base score is 8.6 out of 10.