SB2020061814 - Information disclosure in Cisco IP Phones Series 7800 and Series 8800
Published: June 18, 2020
Security Bulletin ID
SB2020061814
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2020-3360)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper access controls on the web-based management interface of an affected device within the Web Access feature. A remote attacker can send specially crafted requests, bypass access restrictions and gain unauthorized access to sensitive information, such as device call logs that contain names, usernames, and phone numbers of users of the device.
Remediation
Install update from vendor's website.