Medium severity · published Nov 6, 2024
CVE-2024-20445
Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device.
This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records.
Note: Web Access is disabled by default.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cisco Session Initiation Protocol (SIP) Software · Cisco
12.1(1)SR1; 11.5(1); 10.3(2); 10.2(2); 10.3(1); 10.3(1)SR4; +34 more · source: vendor
DP
Desk Phone 9841 Firmware · Cisco
3.1(1); 3.1(1) · source: NVD
DP
Desk Phone 9851 Firmware · Cisco
3.1(1); 3.1(1) · source: NVD
DP
Desk Phone 9861 Firmware · Cisco
3.1(1); 3.1(1) · source: NVD
DP
Desk Phone 9871 Firmware · Cisco
3.1(1); 3.1(1) · source: NVD
IC
IP Conference Phone 7832 Firmware · Cisco
before 14.3\(1\) · source: NVD
IC
IP Conference Phone 8831 Firmware · Cisco
before 14.3\(1\) · source: NVD
IC
IP Conference Phone 8832 Firmware · Cisco
before 14.3\(1\) · source: NVD
IP
IP Phone 7811 Firmware · Cisco
before 14.3\(1\) · source: NVD
IP
IP Phone 7821 Firmware · Cisco
before 14.3\(1\) · source: NVD
IP
IP Phone 7841 Firmware · Cisco
before 14.3\(1\) · source: NVD
IP
IP Phone 7861 Firmware · Cisco
before 14.3\(1\) · source: NVD
Affected product
CS
Cisco Session Initiation Protocol (SIP) Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20445
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-infodisc-sbyqQVbG
More from Cisco Session Initiation Protocol (SIP) Software
7.5
CVE-2026-20281
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
7.5
CVE-2025-20350
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Denial of Service Vulnerability
7.5
CVE-2025-20336
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Disclosure Vulnerability
6.5
CVE-2021-1379
Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities
6.1
CVE-2025-20351
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Cross-Site Scripting Vulnerability