CVE-2022-20660 Cisco IP Phones Information Disclosure Vulnerability
An unauthenticated physical attacker can extract confidential information from Cisco IP Phones by accessing unencrypted flash memory chips.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-20660?
CVE-2022-20660 is a medium-severity vulnerability in Cisco Session Initiation Protocol (SIP) Software, published on 14 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks.
Weakness: CWE-312
Which versions are affected by CVE-2022-20660?
It affects 20 products.
Products include Cisco Ip Conference Phone 7832 Firmware, Cisco Ip Conference Phone 8832 Firmware, Cisco Ip Phone 7811 Firmware, Cisco Ip Phone 7821 Firmware, Cisco Ip Phone 7841 Firmware, Cisco Ip Phone 7861 Firmware and 14 more.
How do I fix CVE-2022-20660?
No fix has been published for CVE-2022-20660 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-20660 being exploited?
There is no known exploitation of CVE-2022-20660 in the wild and no public exploit code.
Other vulnerabilities in Cisco Session Initiation Protocol (SIP) Software
- CVE-2020-3111 Cisco IP Phone Remote Code Execution and Denial of Service Vulnerability
- CVE-2019-1635 Cisco IP Phone 7800 Series and 8800 Series Session Initiation Protocol XML Denial of Service Vulnerability
- CVE-2021-1379 Memory corruption in Cisco IP Phones with Multiplatform Firmware
- CVE-2019-1684 Denial of service in Cisco IP Phone 8800 Series Software
- CVE-2021-34711 Cisco IP Phone Software Arbitrary File Read Vulnerability
Sources
Also known as GHSA-47mp-v7q4-xpjw.