Auth bypass in Cisco Session Initiation Protocol (Sip) Software
CVE-2023-20018
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Cisco Session Initiation Protocol (Sip) Software — versions 9.3(4) 3rd Party, 9.3(4)SR3 3rd Party, 9.3(4)SR1 3rd Party
- Cisco Ip Phone 7800
- Cisco Ip Phone 7800 Firmware
- Cisco Ip Phone 7811
- Cisco Ip Phone 7811 Firmware
- Cisco Ip Phone 7821
- Cisco Ip Phone 7821 Firmware
- Cisco Ip Phone 7832
- Cisco Ip Phone 7832 Firmware
- Cisco Ip Phone 7841
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-20018?
- CVE-2023-20018 is a high-severity vulnerability in Cisco Session Initiation Protocol (Sip) Software, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 8.6/10. Published 2023-01-20.
- How severe is CVE-2023-20018?
- High severity. CVSS v3 base score is 8.6 out of 10.