Cisco IP Phone Security Vulnerability

Both the Cisco IP Phone 8800 Series and the Cisco IP Phone 7800 Series are Cisco (Cisco) devices. The Cisco IP Phone 8800 Series is an 8800-series IP phone. The Cisco IP Phone 7800 Series is an IP phone in the 7800 series.

Thursday, November 5, 2020, 10:19 GMT

Cisco IP Phone has a security flaw that can lead to fatal errors, resulting in service denial.

Image source: cisco.com

A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop responding to incoming calls, drop connected calls, or unexpectedly reload. 

The vulnerability is due to insufficient TCP ingress packet rate limiting. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the targeted device. A successful exploit could allow the attacker to impact operations of the phone or cause the phone to reload, leading to a denial of service (DoS) condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-flood-dos-YnU9EXOv

Solution:

At present, the manufacturer has released upgrade patches to fix the vulnerabilities. The link to obtain the patches: