CVE-2022-20660: Cisco IP Phones Information Disclosure Vulnerability
A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cisco IP Phone vulnerability?
The vulnerability ID for this Cisco IP Phone vulnerability is CVE-2022-20660.
What is the severity rating of CVE-2022-20660?
The severity rating of CVE-2022-20660 is medium, with a CVSS score of 4.6.
Which Cisco IP Phone models are affected by CVE-2022-20660?
Several Cisco IP Phone models are affected by CVE-2022-20660, including Cisco Ip Conference Phone 7832, Cisco Ip Conference Phone 8832, Cisco Ip Phone 7811, Cisco Ip Phone 7821, Cisco Ip Phone 7841, Cisco Ip Phone 7861, Cisco Ip Phone 8811, Cisco Ip Phone 8841, Cisco Ip Phone 8845, Cisco Ip Phone 8851, Cisco Ip Phone 8861, and Cisco Ip Phone 8865.
What is the vulnerability in Cisco IP Phone models due to?
The vulnerability in Cisco IP Phone models is due to unencrypted storage of confidential information on the affected devices.
How can an attacker exploit CVE-2022-20660?
An unauthenticated, physical attacker can exploit CVE-2022-20660 by obtaining confidential information from an affected Cisco IP Phone.