{"uuid": "cde15913-bca3-4965-a304-5fda07ac7a8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-20078", "type": "seen", "source": "https://t.me/hacking_Attack/92715", "content": "Black Hat Ethical Hacking\nCritical Security Vulnerability Discovered in Cisco IP Phones\n\nCritical Security Vulnerability Discovered in Cisco IP PhonesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Attackers can Exploit the flawIn a recent announcement, Cisco has acknowledged two high-severity vulnerabilities in its Web UI, found in multiple IP Phone models. According to Cisco, remote attackers can exploit the RCE flaw (CVE-2023-20078) to inject arbitrary commands, which will be executed with root privileges following successful exploitation.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses DoS flaw not patched yetMeanwhile, the second vulnerability (CVE-2023-20079) allows attackers to trigger denial-of-service (DoS) conditions. Both vulnerabilities are the result of insufficient validation of user-supplied input and can be exploited using maliciously crafted requests sent to the targeted device\u2019s web-based management interface.\n\nWhile Cisco has released security updates to address the CVE-2023-20078 RCE vulnerability, it has stated that it will not release patches to fix the CVE-2023-20079 DoS flaw. It\u2019s important to note that the list of affected devices includes Cisco IP Phone 6800, 7800, and 8800 series devices with Multiplatform Firmware, and the Unified IP Conference Phone 8831, Unified IP Conference Phone 8831 with Multiplatform Firmware, and Unified IP Phone 7900 Series, which are only vulnerable to DoS attacks.\nTrending: Security Engineer vs. Software Engineer\nTrending: Offensive Security Tool: SQLMutant Cisco advise to adminsCisco has urged admins to disable CDP on affected IP Phone devices supporting Link Layer Discovery Protocol (LLDP) to remove the attack vector.\nTrending: Stealc, New Information Stealer Malware Emerges on Dark Web\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-1-300x150.png Crypto Companies Under Attack: New Campaign Delivers Parallax RAT MalwareMarch 1, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-9-300x150.png Critical vulnerabilities discovered in popular Houzez theme and plugin for WordPressFebruary 28, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-1-300x150.png The Evolution of a Cryptomining Threat on macOS: What You Need to KnowFebruary 24, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-3-300x150.png S1deload Stealer: The New Malware Threat Targeting Social Media AccountsFebruary 23, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.\nThe post Critical Security Vulnerability Discovered in Cisco IP Phones first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:01:24.057985Z"}