CVE-2024-20376: Cisco Video Phone 8875 DoS Vulnerability

CVE-2024-20376 Overview

CVE-2024-20376 is a denial of service vulnerability in the web-based management interface of Cisco IP Phone firmware. An unauthenticated, remote attacker can send a crafted HTTP request to an affected device and force it to reload. The flaw stems from insufficient validation of user-supplied input, classified under [CWE-787] out-of-bounds write.

The vulnerability affects a broad range of Cisco IP Phone and Video Phone models running Multiplatform Firmware, including the 6800, 7800, 8800 series and the Video Phone 8875. Exploitation requires no authentication or user interaction, and successful attacks disrupt voice communications across affected devices.

Critical Impact

An unauthenticated remote attacker can trigger device reloads on Cisco IP Phones, interrupting enterprise voice services and disabling phone availability on demand.

Affected Products

• Cisco Video Phone 8875 Firmware
• Cisco IP Phone 6800 Series with Multiplatform Firmware (6821, 6841, 6851, 6861, 6871)
• Cisco IP Phone 7800 and 8800 Series with Multiplatform Firmware (7811, 7821, 7832, 7841, 7861, 8811, 8832, 8841, 8845, 8851, 8861, 8865)

Discovery Timeline

• 2024-05-01 - CVE-2024-20376 published to NVD
• 2026-01-05 - Last updated in NVD database

Technical Details for CVE-2024-20376

Vulnerability Analysis

The vulnerability resides in the HTTP request handling logic of the web-based management interface exposed by Cisco IP Phone firmware. The interface fails to properly validate user-supplied input contained within incoming requests. When the device processes a malformed or unexpected input field, it writes data outside the bounds of an intended memory region, triggering a fault that forces the firmware to reload.

The weakness is categorized as an out-of-bounds write [CWE-787]. Because the affected interface accepts requests over the network without requiring authentication, any attacker with network reachability to the phone's management interface can trigger the condition. Repeated exploitation produces sustained denial of service, preventing the device from registering with call control infrastructure and answering or placing calls.

Root Cause

The root cause is insufficient input validation on parameters parsed by the embedded web server. Crafted values reach a memory write path that does not enforce length or type constraints, resulting in memory corruption that the firmware cannot recover from gracefully. The device terminates the offending process and performs a full reload to restore a known good state.

Attack Vector

Exploitation is network-based and requires no credentials or user interaction. An attacker sends a single crafted HTTP or HTTPS request to the phone's management interface. The request triggers the out-of-bounds write and forces the device to reboot. No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.615%.

No verified exploitation code is available. Refer to the Cisco Security Advisory for vendor technical details.

Detection Methods for CVE-2024-20376

Indicators of Compromise

• Unexpected reboots or reload cycles on Cisco IP Phones with no corresponding administrative action or firmware update event.
• Inbound HTTP or HTTPS requests to phone management interfaces originating from unauthorized network segments or untrusted hosts.
• Loss of SIP registration for affected devices coinciding with anomalous web management traffic.

Detection Strategies

• Inspect network flows for HTTP/HTTPS connections targeting Cisco IP Phone management ports from sources outside the voice VLAN or management subnet.
• Correlate phone reload events from call manager logs with web request logs at upstream firewalls or proxies.
• Deploy signature-based intrusion detection rules to flag malformed HTTP requests directed at phone web interfaces.

Monitoring Recommendations

• Forward syslog and call manager event data for IP phones into a centralized SIEM or data lake for correlation with network telemetry.
• Monitor for repeated device reload patterns across multiple phones, which may indicate active exploitation attempts.
• Track web management interface accessibility through periodic configuration audits to ensure exposure remains minimized.

How to Mitigate CVE-2024-20376

Immediate Actions Required

• Apply the firmware updates referenced in the Cisco Security Advisory cisco-sa-ipphone-multi-vulns-cXAhCvS for all affected IP Phone and Video Phone models.
• Restrict access to phone web management interfaces using network access control lists, allowing only trusted management hosts.
• Audit phone configurations to confirm that the web administration interface is disabled where not required for operational support.

Patch Information

Cisco has published fixed firmware releases for the affected IP Phone and Video Phone models. Consult the Cisco Security Advisory for the specific fixed firmware versions corresponding to each product line and upgrade procedures.

Workarounds

• Disable the web-based management interface on IP Phones when remote administration is not actively required.
• Segment voice infrastructure onto a dedicated VLAN with strict ingress filtering at Layer 3 boundaries.
• Place management interfaces behind a jump host or VPN to prevent direct reachability from general-purpose user networks.

# Example ACL restricting access to phone web management to a trusted subnet
ip access-list extended PHONE-MGMT-RESTRICT
 permit tcp 10.10.0.0 0.0.0.255 any eq 80
 permit tcp 10.10.0.0 0.0.0.255 any eq 443
 deny   tcp any any eq 80
 deny   tcp any any eq 443
 permit ip any any