cisco-sa-20190320-ip-phone-csrf: Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-csrf
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20190320-ip-phone-csrf?
The cisco-sa-20190320-ip-phone-csrf vulnerability is rated as high severity due to its potential for unauthorized access and impact on device integrity.
How do I fix cisco-sa-20190320-ip-phone-csrf?
To fix cisco-sa-20190320-ip-phone-csrf, apply the latest patch provided by Cisco for the affected Cisco IP Phone 8800 Series.
Who is affected by cisco-sa-20190320-ip-phone-csrf?
The cisco-sa-20190320-ip-phone-csrf vulnerability affects users of the Cisco IP Phone 8800 Series using the web-based management interface.
Can cisco-sa-20190320-ip-phone-csrf be exploited remotely?
Yes, cisco-sa-20190320-ip-phone-csrf can be exploited remotely by an unauthenticated attacker through a cross-site request forgery attack.
What is the nature of the attack related to cisco-sa-20190320-ip-phone-csrf?
The nature of the attack related to cisco-sa-20190320-ip-phone-csrf is a cross-site request forgery (CSRF), which can lead to unauthorized actions on the IP phone's management interface.