CVE-2022-20968 Memory corruption in Cisco Session Initiation Protocol (SIP) Software
An unauthenticated adjacent attacker can cause a stack overflow via crafted CDP packets, leading to remote code execution or denial of service on Cisco IP phones.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-20968?
CVE-2022-20968 is a high-severity memory corruption vulnerability in Cisco Session Initiation Protocol (SIP) Software, published on 8 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device. This vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol traffic to an affected device. A successful exploit could allow the attacker to cause a stack overflow, resulting in possible remote code execution or a denial of service (DoS) condition on an affected device.
Weakness: CWE-787
Which versions are affected by CVE-2022-20968?
It affects 13 products.
Products include Cisco Ip Phone 7811 Firmware, Cisco Ip Phone 7821 Firmware, Cisco Ip Phone 7832 Firmware, Cisco Ip Phone 7841 Firmware, Cisco Ip Phone 7861 Firmware, Cisco Ip Phone 8811 Firmware and 7 more.
How do I fix CVE-2022-20968?
No fix has been published for CVE-2022-20968 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-20968 being exploited?
There is no known exploitation of CVE-2022-20968 in the wild and no public exploit code.
Sources
Also known as GHSA-39vj-2wxm-c37w.