A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/165567/Cisco-IP-Phone-Cleartext-Password-Storage.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jan/34 | Mailing List Third Party Advisory |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-info-disc-fRdJfOxA | Vendor Advisory |
| http://packetstormsecurity.com/files/165567/Cisco-IP-Phone-Cleartext-Password-Storage.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jan/34 | Mailing List Third Party Advisory |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-info-disc-fRdJfOxA | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
Configuration 11 (hide)
| AND |
|
Configuration 12 (hide)
| AND |
|
Configuration 13 (hide)
| AND |
|
Configuration 14 (hide)
| AND |
|
Configuration 15 (hide)
| AND |
|
Configuration 16 (hide)
| AND |
|
Configuration 17 (hide)
| AND |
|
Configuration 18 (hide)
| AND |
|
Configuration 19 (hide)
| AND |
|
Configuration 20 (hide)
| AND |
|
History
21 Nov 2024, 06:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/165567/Cisco-IP-Phone-Cleartext-Password-Storage.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2022/Jan/34 - Mailing List, Third Party Advisory | |
| References | () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-info-disc-fRdJfOxA - Vendor Advisory |
22 Jan 2022, 02:36
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 4.6 |
| CWE | CWE-312 | |
| CPE | cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_8865:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_conference_phone_7832:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:wireless_ip_phone_8821-ex:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:unified_ip_phone_7975g:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:wireless_ip_phone_8821:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_conference_phone_7832_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:unified_ip_phone_7975g_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:unified_ip_phone_7965g_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:unified_ip_phone_7945g:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:unified_sip_phone_3905:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:unified_ip_phone_7945g_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:unified_ip_conference_phone_8831_for_third-party_call_control_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:unified_sip_phone_3905_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:cisco:unified_ip_conference_phone_8831_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:unified_ip_conference_phone_8831:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:unified_ip_conference_phone_8831_for_third-party_call_control:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:ip_conference_phone_8832:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:unified_ip_phone_7965g:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:* |
|
| References | (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-info-disc-fRdJfOxA - Vendor Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/165567/Cisco-IP-Phone-Cleartext-Password-Storage.html - Exploit, Third Party Advisory, VDB Entry | |
| References | (FULLDISC) http://seclists.org/fulldisclosure/2022/Jan/34 - Mailing List, Third Party Advisory |
17 Jan 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jan 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jan 2022, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks. |
14 Jan 2022, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-01-14 05:15
Updated : 2024-11-21 06:43
NVD link : CVE-2022-20660
Mitre link : CVE-2022-20660
CVE.ORG link : CVE-2022-20660
JSON object : View
Products Affected
cisco
- unified_ip_phone_7965g_firmware
- ip_phone_8811_firmware
- wireless_ip_phone_8821_firmware
- unified_ip_phone_7975g_firmware
- ip_phone_7821
- unified_ip_phone_7945g
- unified_sip_phone_3905_firmware
- ip_phone_8845
- unified_ip_conference_phone_8831
- wireless_ip_phone_8821
- ip_conference_phone_8832_firmware
- ip_conference_phone_8832
- ip_phone_7861_firmware
- unified_ip_phone_7945g_firmware
- wireless_ip_phone_8821-ex
- wireless_ip_phone_8821-ex_firmware
- ip_phone_8851
- ip_phone_7821_firmware
- ip_phone_8845_firmware
- unified_ip_conference_phone_8831_for_third-party_call_control_firmware
- unified_ip_conference_phone_8831_for_third-party_call_control
- ip_phone_7811
- ip_phone_7861
- ip_phone_8851_firmware
- ip_phone_8841_firmware
- ip_conference_phone_7832
- ip_phone_7841
- unified_ip_phone_7975g
- ip_phone_8865_firmware
- ip_phone_8811
- ip_phone_8865
- ip_phone_8841
- ip_phone_7841_firmware
- unified_sip_phone_3905
- ip_phone_7811_firmware
- unified_ip_conference_phone_8831_firmware
- ip_phone_8861
- unified_ip_phone_7965g
- ip_conference_phone_7832_firmware
- ip_phone_8861_firmware
CWE
CWE-312
Cleartext Storage of Sensitive Information