01 Record

CVE-2023-20221

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site

MediumPUBLISHEDCNA: cisco

CNA base score6.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

View raw JSON

02 Description

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.33% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 24.8% of scored records. A rank, not a probability.
NVD base score: 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2023-08-16 21:01Z3 YR AGO

Last updated

2024-08-02 09:05Z2 YR AGO

Reserved

2022-10-27

Assigning CNA

cisco

Record state

PUBLISHED

Severity

Medium (CVSS 6.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

CWE-352Cross-Site Request Forgery (CSRF)Compound

Data version

5.1

Document digest

4f9e970b025f96987529cea8e3b39ee2a0c08e46529ede2bf089cef75d9b8ddd

05 Affected products

VendorProductVersionsPlatforms

CiscoCisco IP Phones with Multiplatform Firmware11.3.1 MSR2-6, 11.3.1 MSR3-3, 11.3.2, 11.3.3, 11.3.4, 11.3.5, 11.3.3 MSR1, 11.3.6, 11-3-1MPPSR4UPG, 11.3.7, 11-3-1MSR2UPG, 11.3.6SR1, 11.3.7SR1, 11.3.7SR2, 11.0.0, 11.0.1, 11.0.1 MSR1-1, 11.0.2, 11.1.1, 11.1.1 MSR1-1, 11.1.1 MSR2-1, 11.1.2, 11.1.2 MSR1-1, 11.1.2 MSR3-1, 11.2.1, 11.2.2, 11.2.3, 11.2.3 MSR1-1, 11.2.4, 11.3.1, 11.3.1 MSR1-3—

CiscoCisco PhoneOS1.0.1—

06 References

sec.cloudapps.cisco.comcisco-sa-ipphone-csrf-HOCmXW2chttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-csrf-HOCmXW2c

01 Record index

CVE-2023-20221

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2023-20221

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References