CVE-2024-20534

Description

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform Firmware could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks against users. This vulnerability exists because the web UI of an affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: To exploit this vulnerability, Web Access must be enabled on the phone and the attacker must have Admin credentials on the device. Web Access is disabled by default.

Reserved 2023-11-08 | Published 2024-11-06 | Updated 2024-11-06 | Assigner cisco

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unknown

11.1.2
affected

11.2.1
affected

11.2.3
affected

11.2.2
affected

11.2.3 MSR1-1
affected

11.1.2 MSR1-1
affected

11.1.1
affected

11.1.2 MSR3-1
affected

11.0.0
affected

11.1.1 MSR1-1
affected

11.0.1
affected

11.1.1 MSR2-1
affected

11.2.4
affected

11.0.1 MSR1-1
affected

11.0.2
affected

11.3.1
affected

11.3.1 MSR1-3
affected

11.3.2
affected

11.3.1 MSR2-6
affected

11-3-1MSR2UPG
affected

4.7.1
affected

4.6 MSR1
affected

11.3.1 MSR3-3
affected

4.8.1
affected

11.3.3
affected

11.3.1 MSR4-1
affected

11.3.4
affected

4.8.1 SR1
affected

11.3.5
affected

11.3.3 MSR1
affected

5.0.1
affected

11.3.3 MSR2
affected

11.3.6
affected

11-3-1MPPSR4UPG
affected

11.3.6SR1
affected

11.3.7
affected

5.1.1
affected

11.3.7SR1
affected

12.0.1
affected

12.0.2
affected

11.3.7SR2
affected

12.0.3
affected

12.0.3SR1
affected

12.0.4
affected

12.0.4SR1
affected

12.0.5
affected

12.0.5SR1
affected

12.0.3SR2
affected

Default status
unknown

3.1(1)
affected

3.0(1)
affected

3.1(1)SR1
affected

References

sec.cloudapps.cisco.com/...dvisory/cisco-sa-mpp-xss-8tAV2TvF (cisco-sa-mpp-xss-8tAV2TvF)

cve.org (CVE-2024-20534)

nvd.nist.gov (CVE-2024-20534)

Download JSON