CVE-2024-20357
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated,...
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device.
This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device.
This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
- Record
CVE-2024-20357- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2024-18072
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device.
This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
- Record
EUVD-2024-18072- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-49gp-r5pw-pqg8
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated,...
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device.
This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
- Record
GHSA-49gp-r5pw-pqg8- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device.
This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device.
- Record
CVE-2024-20357- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-787
- Updated
- 2026-11-02
Affected products
- cisco ip phones with multiplatform firmware
- cisco phoneos
- cisco ip phone 6821 with multiplatform firmware
- cisco ip phone 6825 with multiplatform firmware
- cisco ip phone 6841 with multiplatform firmware
- cisco ip phone 6851 with multiplatform firmware
- cisco ip phone 6861 with multiplatform firmware
- cisco ip phone 6871 with multiplatform firmware
- cisco ip phone 7811 with multiplatform firmware
- cisco ip phone 7821 with multiplatform firmware
- cisco ip phone 7832 with multiplatform firmware
- cisco ip phone 7841 with multiplatform firmware
Show 10 moreShow less
- cisco ip phone 7861 with multiplatform firmware
- cisco ip phone 8800 series with multiplatform firmware
- cisco ip phone 8811 with multiplatform firmware
- cisco ip phone 8832 with multiplatform firmware
- cisco ip phone 8841 with multiplatform firmware
- cisco ip phone 8845 with multiplatform firmware
- cisco ip phone 8851 with multiplatform firmware
- cisco ip phone 8861 with multiplatform firmware
- cisco ip phone 8865 with multiplatform firmware
- cisco video phone 8875 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-20357 is a medium vulnerability (CVSS 5.9) in Cisco Ip Phones With Multiplatform Firmware, published May 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. No source names a fixed version.