High severity · published Feb 5, 2020
CVE-2020-3111
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root…
8.8
CVSS
3.1%
EPSS
No
On KEV
Description
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to the targeted IP phone. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
IP Conference Phone 7832 Firmware · Cisco
before 12.7\(1\) · source: NVD
IC
IP Conference Phone 7832 With Multiplatform Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IC
IP Conference Phone 8832 Firmware · Cisco
before 12.7\(1\) · source: NVD
IC
IP Conference Phone 8832 With Multiplatform Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 6821 Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 6841 Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 6851 Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 6861 Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 6871 Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 7811 Firmware · Cisco
before 12.7\(1\) · source: NVD
IP
IP Phone 7811 With Multiplatform Firmware · Cisco
before 11.3\(1\)sr1 · source: NVD
IP
IP Phone 7821 Firmware · Cisco
before 12.7\(1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3111
Third Party Advisory
http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-voip-phones-rce-dos
More from IP Conference Phone 7832 Firmware
7.5
CVE-2019-1922
A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS)…
7.5
CVE-2019-1635
A vulnerability in the call-handling functionality of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated,…
6.5
CVE-2021-1379
Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities
6.5
CVE-2019-1684
Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol and Link Layer Discovery Protocol Denial of Service Vulnerability
5.5
CVE-2021-34711
A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system
