cisco-sa-phone-logs-2O7f7ExM: Cisco IP Phones Call Log Information Disclosure Vulnerability
A vulnerability in the Web Access feature of Cisco IP Phones could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-logs-2O7f7ExM
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-phone-logs-2O7f7ExM?
The severity of cisco-sa-phone-logs-2O7f7ExM is categorized as high due to its potential for unauthorized information disclosure.
How do I fix cisco-sa-phone-logs-2O7f7ExM?
To fix cisco-sa-phone-logs-2O7f7ExM, update your Cisco IP Phones to the latest firmware that addresses this vulnerability.
What type of devices are affected by cisco-sa-phone-logs-2O7f7ExM?
cisco-sa-phone-logs-2O7f7ExM affects Cisco IP Phones with improper access controls on their web-based management interface.
Can cisco-sa-phone-logs-2O7f7ExM be exploited remotely?
Yes, cisco-sa-phone-logs-2O7f7ExM can be exploited remotely by an unauthenticated attacker to view sensitive information.
What kind of information can be exposed due to cisco-sa-phone-logs-2O7f7ExM?
Due to cisco-sa-phone-logs-2O7f7ExM, sensitive information such as call logs and device configurations may be exposed.