CVE-2024-20454

Summary

CVE-2024-20454 refers to multiple vulnerabilities discovered in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones. An unauthenticated, remote attacker can exploit these vulnerabilities by sending a maliciously crafted HTTP request. The underlying issue stems from improper handling of incoming HTTP packets, resulting in a buffer overflow. Successful exploitation grants the attacker root privileges to execute arbitrary commands on the affected device.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.