CVE-2023-20265

Summary

CVE-2023-20265 is a stored cross-site scripting (XSS) vulnerability affecting a small subset of Cisco IP Phones. This issue lies in the web-based management interface, which fails to adequately validate user-supplied input. An authenticated, remote attacker can exploit this flaw by convincing a user to view a malicious webpage. If successful, the attacker can execute arbitrary script code within the interface or gain access to sensitive browser-based information. To exploit the vulnerability, the attacker must hold valid credentials to access the affected device's web-based management interface.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.