CVE-2024-20378 Overview
CVE-2024-20378 is an information disclosure vulnerability in the web-based management interface of Cisco IP Phone firmware. The flaw allows an unauthenticated, remote attacker to retrieve sensitive information from an affected device by connecting to specific endpoints that lack authentication controls. A successful exploit can expose user credentials and captured traffic, including Voice over IP (VoIP) call recordings that an attacker could later replay. The vulnerability is tracked under [CWE-305: Authentication Bypass by Primary Weakness] and affects a wide range of Cisco IP Phone 6800, 7800, 8800, and Video Phone 8875 series devices running Multiplatform Firmware.
Critical Impact
Unauthenticated remote attackers can extract VoIP call data and user credentials directly from affected Cisco IP phones over the network.
Affected Products
- Cisco IP Phone 6821, 6841, 6851, 6861, and 6871 with Multiplatform Firmware
- Cisco IP Phone 7811, 7821, 7841, and 7861 with Multiplatform Firmware
- Cisco IP Phone 8811, 8841, 8851, 8851NR, and 8861 with Multiplatform Firmware, and Cisco Video Phone 8875 with Multiplatform Firmware
Discovery Timeline
- 2024-05-01 - CVE-2024-20378 published to NVD
- 2026-01-05 - Last updated in NVD database
Technical Details for CVE-2024-20378
Vulnerability Analysis
The vulnerability resides in the web-based management interface used to administer Cisco IP Phones running Multiplatform Firmware. Specific endpoints in this interface do not enforce authentication before returning data. An attacker with network reachability to the phone can query these endpoints and receive sensitive content without supplying credentials.
The Exploit Prediction Scoring System (EPSS) places this issue in a higher likelihood band than average, reflecting the simplicity of the access path. The attack requires no user interaction, no privileges, and no local presence on the device.
Root Cause
The root cause is missing authentication on specific HTTP endpoints exposed by the phone's management interface. The firmware treats these endpoints as accessible to any client capable of opening a TCP connection. This design oversight maps to [CWE-305], where the primary authentication mechanism can be bypassed because it is not applied to all sensitive resources.
Attack Vector
An attacker reaches the affected phone over the network and issues HTTP requests to the unauthenticated endpoints. The endpoints return data that can include user credentials and captured call traffic. Because VoIP signaling and media data can be recovered, an attacker can reconstruct and replay calls handled by the device. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Cisco Security Advisory for vendor-confirmed technical details.
Detection Methods for CVE-2024-20378
Indicators of Compromise
- Unexpected inbound HTTP or HTTPS connections from external or unauthorized internal hosts to the management interface of Cisco IP phones.
- Access log entries on phones showing successful requests to administrative endpoints without an authenticated session.
- Outbound transfers of unusually large response payloads from phone IP addresses to non-PBX systems.
Detection Strategies
- Inspect network telemetry for HTTP requests targeting Cisco IP Phone management ports from clients outside the voice VLAN.
- Correlate phone web interface access events with authenticated admin sessions to identify anonymous endpoint queries.
- Hunt for repeated, scripted access patterns to phone management URLs that resemble enumeration of unauthenticated endpoints.
Monitoring Recommendations
- Continuously baseline traffic to and from VoIP devices and alert on deviations involving HTTP management traffic.
- Capture and review syslog data from Cisco IP phones for unexpected configuration reads or interface access events.
- Monitor segmentation boundaries between data and voice VLANs for cross-VLAN connections to phone management interfaces.
How to Mitigate CVE-2024-20378
Immediate Actions Required
- Upgrade affected Cisco IP Phone Multiplatform Firmware to a fixed release as listed in the Cisco Security Advisory.
- Inventory all Cisco IP Phone 6800, 7800, 8800, and Video Phone 8875 devices and identify those running vulnerable firmware versions, including 12.0.4.
- Restrict network reachability to the phone web management interface using ACLs or firewall policies until patching is complete.
Patch Information
Cisco has released firmware updates that address CVE-2024-20378. Administrators should consult the Cisco Security Advisory cisco-sa-ipphone-multi-vulns-cXAhCvS for fixed firmware versions corresponding to each affected phone model and to plan staged upgrades across the fleet.
Workarounds
- Disable the web-based management interface on Cisco IP phones where it is not required for operations.
- Place IP phones in a dedicated voice VLAN with strict ACLs blocking HTTP and HTTPS access from user and guest networks.
- Limit administrative access to the phone web interface to a small set of authorized management hosts via firewall rules.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
