CVE-2024-20445 - Vulnerability Details

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device.

This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records.
Note: Web Access is disabled by default.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00661.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Cisco Subscribe	Desk Phone 9841 Subscribe Desk Phone 9841 Firmware Subscribe Desk Phone 9851 Subscribe Desk Phone 9851 Firmware Subscribe Desk Phone 9861 Subscribe Desk Phone 9861 Firmware Subscribe Desk Phone 9871 Subscribe Desk Phone 9871 Firmware Subscribe Ip Conference Phone 7832 Subscribe Ip Conference Phone 7832 Firmware Subscribe Ip Conference Phone 8831 Subscribe Ip Conference Phone 8831 Firmware Subscribe Ip Conference Phone 8832 Subscribe Ip Conference Phone 8832 Firmware Subscribe Ip Phone 7811 Subscribe Ip Phone 7811 Firmware Subscribe Ip Phone 7821 Subscribe Ip Phone 7821 Firmware Subscribe Ip Phone 7841 Subscribe Ip Phone 7841 Firmware Subscribe Ip Phone 7861 Subscribe Ip Phone 7861 Firmware Subscribe Ip Phone 8811 Subscribe Ip Phone 8811 Firmware Subscribe Ip Phone 8841 Subscribe Ip Phone 8841 Firmware Subscribe Ip Phone 8845 Subscribe Ip Phone 8845 Firmware Subscribe Ip Phone 8851 Subscribe Ip Phone 8851 Firmware Subscribe Ip Phone 8851nr Subscribe Ip Phone 8851nr Firmware Subscribe Ip Phone 8861 Subscribe Ip Phone 8861 Firmware Subscribe Sip Ip Phone Software Subscribe Video Phone 8875 Subscribe Video Phone 8875 Firmware Subscribe

Configuration 1 [-]

AND

OR	cpe:2.3:o:cisco:desk_phone_9841_firmware:3.1\(1\):-::::::
	cpe:2.3:o:cisco:desk_phone_9841_firmware:3.1\(1\):sr1::::::

cpe:2.3:h:cisco:desk_phone_9841:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:cisco:desk_phone_9851_firmware:3.1\(1\):-::::::
	cpe:2.3:o:cisco:desk_phone_9851_firmware:3.1\(1\):sr1::::::

cpe:2.3:h:cisco:desk_phone_9851:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:cisco:desk_phone_9861_firmware:3.1\(1\):-::::::
	cpe:2.3:o:cisco:desk_phone_9861_firmware:3.1\(1\):sr1::::::

cpe:2.3:h:cisco:desk_phone_9861:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

OR	cpe:2.3:o:cisco:desk_phone_9871_firmware:3.1\(1\):-::::::
	cpe:2.3:o:cisco:desk_phone_9871_firmware:3.1\(1\):sr1::::::

cpe:2.3:h:cisco:desk_phone_9871:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:cisco:ip_conference_phone_7832_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_conference_phone_7832:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:cisco:ip_conference_phone_8831_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_conference_phone_8831:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_conference_phone_8832:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_7811:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_7821:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_7841:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_7861:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_8811:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_8841:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_8845:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_8851:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:cisco:ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_8851nr:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cisco:ip_phone_8861:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

OR	cpe:2.3:o:cisco:video_phone_8875_firmware::::::::
	cpe:2.3:o:cisco:video_phone_8875_firmware:2.3\(1\):-::::::
	cpe:2.3:o:cisco:video_phone_8875_firmware:2.3\(1\):sr1::::::

cpe:2.3:h:cisco:video_phone_8875:-:*:*:*:*:*:*:*

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-18160	A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-infodisc-sbyqQVbG

History

Mon, 05 Jan 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco desk Phone 9841 Cisco desk Phone 9841 Firmware Cisco desk Phone 9851 Cisco desk Phone 9851 Firmware Cisco desk Phone 9861 Cisco desk Phone 9861 Firmware Cisco desk Phone 9871 Cisco desk Phone 9871 Firmware Cisco ip Conference Phone 7832 Cisco ip Conference Phone 7832 Firmware Cisco ip Conference Phone 8831 Cisco ip Conference Phone 8831 Firmware Cisco ip Conference Phone 8832 Cisco ip Conference Phone 8832 Firmware Cisco ip Phone 7811 Cisco ip Phone 7811 Firmware Cisco ip Phone 7821 Cisco ip Phone 7821 Firmware Cisco ip Phone 7841 Cisco ip Phone 7841 Firmware Cisco ip Phone 7861 Cisco ip Phone 7861 Firmware Cisco ip Phone 8811 Cisco ip Phone 8811 Firmware Cisco ip Phone 8841 Cisco ip Phone 8841 Firmware Cisco ip Phone 8845 Cisco ip Phone 8845 Firmware Cisco ip Phone 8851 Cisco ip Phone 8851 Firmware Cisco ip Phone 8851nr Cisco ip Phone 8851nr Firmware Cisco ip Phone 8861 Cisco ip Phone 8861 Firmware Cisco video Phone 8875 Cisco video Phone 8875 Firmware
CPEs		cpe:2.3:h:cisco:desk_phone_9841:-:::::::* cpe:2.3:h:cisco:desk_phone_9851:-:::::::* cpe:2.3:h:cisco:desk_phone_9861:-:::::::* cpe:2.3:h:cisco:desk_phone_9871:-:::::::* cpe:2.3:h:cisco:ip_conference_phone_7832:-:::::::* cpe:2.3:h:cisco:ip_conference_phone_8831:-:::::::* cpe:2.3:h:cisco:ip_conference_phone_8832:-:::::::* cpe:2.3:h:cisco:ip_phone_7811:-:::::::* cpe:2.3:h:cisco:ip_phone_7821:-:::::::* cpe:2.3:h:cisco:ip_phone_7841:-:::::::* cpe:2.3:h:cisco:ip_phone_7861:-:::::::* cpe:2.3:h:cisco:ip_phone_8811:-:::::::* cpe:2.3:h:cisco:ip_phone_8841:-:::::::* cpe:2.3:h:cisco:ip_phone_8845:-:::::::* cpe:2.3:h:cisco:ip_phone_8851:-:::::::* cpe:2.3:h:cisco:ip_phone_8851nr:-:::::::* cpe:2.3:h:cisco:ip_phone_8861:-:::::::* cpe:2.3:h:cisco:video_phone_8875:-:::::::* cpe:2.3:o:cisco:desk_phone_9841_firmware:3.1\(1\):-:::::: cpe:2.3:o:cisco:desk_phone_9841_firmware:3.1\(1\):sr1:::::: cpe:2.3:o:cisco:desk_phone_9851_firmware:3.1\(1\):-:::::: cpe:2.3:o:cisco:desk_phone_9851_firmware:3.1\(1\):sr1:::::: cpe:2.3:o:cisco:desk_phone_9861_firmware:3.1\(1\):-:::::: cpe:2.3:o:cisco:desk_phone_9861_firmware:3.1\(1\):sr1:::::: cpe:2.3:o:cisco:desk_phone_9871_firmware:3.1\(1\):-:::::: cpe:2.3:o:cisco:desk_phone_9871_firmware:3.1\(1\):sr1:::::: cpe:2.3:o:cisco:ip_conference_phone_7832_firmware:::::::: cpe:2.3:o:cisco:ip_conference_phone_8831_firmware:::::::: cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:::::::: cpe:2.3:o:cisco:ip_phone_7811_firmware:::::::: cpe:2.3:o:cisco:ip_phone_7821_firmware:::::::: cpe:2.3:o:cisco:ip_phone_7841_firmware:::::::: cpe:2.3:o:cisco:ip_phone_7861_firmware:::::::: cpe:2.3:o:cisco:ip_phone_8811_firmware:::::::: cpe:2.3:o:cisco:ip_phone_8841_firmware:::::::: cpe:2.3:o:cisco:ip_phone_8845_firmware:::::::: cpe:2.3:o:cisco:ip_phone_8851_firmware:::::::: cpe:2.3:o:cisco:ip_phone_8851nr_firmware:::::::: cpe:2.3:o:cisco:ip_phone_8861_firmware:::::::: cpe:2.3:o:cisco:video_phone_8875_firmware:::::::: cpe:2.3:o:cisco:video_phone_8875_firmware:2.3\(1\):-:::::: cpe:2.3:o:cisco:video_phone_8875_firmware:2.3\(1\):sr1::::::
Vendors & Products		Cisco desk Phone 9841 Cisco desk Phone 9841 Firmware Cisco desk Phone 9851 Cisco desk Phone 9851 Firmware Cisco desk Phone 9861 Cisco desk Phone 9861 Firmware Cisco desk Phone 9871 Cisco desk Phone 9871 Firmware Cisco ip Conference Phone 7832 Cisco ip Conference Phone 7832 Firmware Cisco ip Conference Phone 8831 Cisco ip Conference Phone 8831 Firmware Cisco ip Conference Phone 8832 Cisco ip Conference Phone 8832 Firmware Cisco ip Phone 7811 Cisco ip Phone 7811 Firmware Cisco ip Phone 7821 Cisco ip Phone 7821 Firmware Cisco ip Phone 7841 Cisco ip Phone 7841 Firmware Cisco ip Phone 7861 Cisco ip Phone 7861 Firmware Cisco ip Phone 8811 Cisco ip Phone 8811 Firmware Cisco ip Phone 8841 Cisco ip Phone 8841 Firmware Cisco ip Phone 8845 Cisco ip Phone 8845 Firmware Cisco ip Phone 8851 Cisco ip Phone 8851 Firmware Cisco ip Phone 8851nr Cisco ip Phone 8851nr Firmware Cisco ip Phone 8861 Cisco ip Phone 8861 Firmware Cisco video Phone 8875 Cisco video Phone 8875 Firmware

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00092}`	epss `{'score': 0.001}`

Wed, 06 Nov 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco sip Ip Phone Software
CPEs		cpe:2.3:a:cisco:sip_ip_phone_software::::::::
Vendors & Products		Cisco Cisco sip Ip Phone Software
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 06 Nov 2024 16:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper storage of sensitive information within the web UI of Session Initiation Protocol (SIP)-based phone loads. An attacker could exploit this vulnerability by browsing to the IP address of a device that has Web Access enabled. A successful exploit could allow the attacker to access sensitive information, including incoming and outgoing call records. Note: Web Access is disabled by default.
Title		Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability
Weaknesses		CWE-200
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-infodisc-sbyqQVbG
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2024-11-06T16:29:06.293Z

Updated: 2024-11-06T22:00:02.234Z

Reserved: 2023-11-08T15:08:07.678Z

Link: CVE-2024-20445

Vulnrichment

Updated: 2024-11-06T17:25:13.438Z

NVD

Status : Analyzed

Published: 2024-11-06T17:15:14.830

Modified: 2026-01-05T14:57:31.500

Link: CVE-2024-20445

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-200

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Projects

JSON object

JSON object

JSON object

JSON object

JSON object