Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-si...

CVE-2023-20221 · published 3 years ago
Summary

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected sy...

What to do
  • Update cisco video_phone_8875_firmware to version 2.0 or later.
Affected software
VendorProductAffected versions
cisco video_phone_8875_firmware < 2.0
cpe:2.3:o:cisco:video_phone_8875_firmware:*:*:*:*:*:*:*:*
cisco ip_phone_6821_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_6825_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_6825_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_6841_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_6841_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_6851_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_6851_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_6861_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_6861_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_6871_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_6871_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_conference_phone_7832_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_conference_phone_7832_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_7811_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_7811_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_7821_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_7821_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_7841_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_7841_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_7861_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_7861_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_conference_phone_8831_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_conference_phone_8831_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_conference_phone_8832_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_conference_phone_8832_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8800_key_expansion_module_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8800_key_expansion_module_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8811_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8841_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8845_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8845_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8851_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8851_key_expansion_module_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8851_key_expansion_module_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8861_key_expansion_module_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8861_key_expansion_module_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8861_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
cisco ip_phone_8865_with_multiplatform_firmware 11-3-1mppsr4upg
11-3-1msr2upg
11.0.0
11.0.1
11.0.1_msr1-1
11.0.2
11.1.1
11.1.1_msr1-1
11.1.1_msr2-1
11.1.2
11.1.2_msr1-1
11.1.2_msr3-1
19 more version ranges
cpe:2.3:o:cisco:ip_phone_8865_with_multiplatform_firmware:11-3-1mppsr4upg:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-si...
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system.

This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform a factory reset of the affected device, resulting in a Denial of Service (DoS) condition.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published16 Aug 2023
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2023-20221 · NVD
Track software like this
Free during beta