CVE-2024-20445: Cisco Desk Phone 9841 Information Disclosure

CVE-2024-20445 Overview

CVE-2024-20445 is an information disclosure vulnerability in the web user interface of multiple Cisco Session Initiation Protocol (SIP) phone product lines. The flaw affects the Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and the Cisco Video Phone 8875. An unauthenticated, remote attacker who can reach the phone's IP address over the network can retrieve sensitive data, including incoming and outgoing call records. The issue stems from improper storage of sensitive information within the phone's web UI. Web Access is disabled by default, which limits exposure to devices where administrators have explicitly enabled the feature.

Critical Impact
Unauthenticated remote attackers with network reachability to an affected phone can retrieve call history and other sensitive information exposed through the SIP phone web UI [CWE-200].

Affected Products

Cisco Desk Phone 9800 Series (models 9841, 9851, 9861, 9871) running firmware 3.1(1) and 3.1(1)SR1
Cisco IP Phone 7800 and 8800 Series, including IP Conference Phone 7832, 8831, and 8832
Cisco Video Phone 8875 running firmware 2.3(1) and 2.3(1)SR1

Discovery Timeline

2024-11-06 - CVE-2024-20445 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20445

Vulnerability Analysis

The vulnerability resides in the web management interface of SIP-based phone loads shipped on affected Cisco desk, conference, and video phones. The web UI stores sensitive operational data, including call detail records, in a location that is reachable without authentication. An attacker who can send HTTP requests to the phone can browse to specific resources and retrieve this data directly. No user interaction, credentials, or elevated privileges are required.

The exposure is limited to confidentiality. The vulnerability does not enable modification of phone configuration, code execution on the device, or disruption of telephony services. Because Web Access is not enabled by default, only devices where an administrator has turned on the web UI are exploitable. Enterprises that provision phones with web management enabled for troubleshooting or bulk administration are the most likely to be exposed.

Root Cause

The root cause is improper storage of sensitive information within the web UI of the SIP phone firmware, tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. Resources containing call history and related metadata are served by the embedded web server without an authentication or authorization check.

Attack Vector

Exploitation occurs over the network. An attacker on the same IP-reachable network segment as the target phone browses to the device's IP address and requests the exposed web UI resources. Because handset provisioning frequently assigns predictable IP ranges in voice VLANs, an attacker who has gained a foothold on the corporate LAN or voice network can enumerate phones and harvest call records at scale. No proof-of-concept exploit or public exploit code was listed for this CVE at time of publication, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-20445

Indicators of Compromise

Unexpected inbound HTTP or HTTPS requests to phone IP addresses on TCP/80 or TCP/443 from workstations or hosts that are not part of the voice management infrastructure.
Web server access logs on affected phones showing requests to call-record or diagnostic pages by non-administrative clients.
Network traffic from the voice VLAN egressing to non-voice destinations following web UI requests to phones.

Detection Strategies

Inventory all Cisco Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875 devices and identify which have Web Access enabled.
Deploy network detection rules that flag HTTP GET requests to phone IP ranges originating from non-administrative subnets.
Correlate authentication events on adjacent workstations with anomalous scanning of the voice VLAN to identify pivoting attempts.

Monitoring Recommendations

Forward switch and firewall flow logs covering the voice VLAN to a centralized analytics platform and alert on unexpected east-west traffic to phones.
Monitor DHCP and ARP tables for new endpoints appearing in voice subnets that do not match approved phone MAC prefixes.
Track configuration drift on phone provisioning templates to catch cases where Web Access is enabled outside of change control.

How to Mitigate CVE-2024-20445

Immediate Actions Required

Disable Web Access on all affected phones unless it is required for a documented operational reason.
Upgrade affected phone firmware to a fixed release as identified in the Cisco Security Advisory.
Segment voice VLANs from user workstation VLANs and restrict management access to approved administrative hosts.

Patch Information

Cisco has published fixed software for the affected phone series. Refer to the Cisco Security Advisory cisco-sa-phone-infodisc-sbyqQVbG for the specific fixed firmware versions and upgrade instructions for each hardware model. Apply the vendor-supplied firmware update through the standard provisioning workflow, such as Cisco Unified Communications Manager or the on-device configuration.

Workarounds

Disable the Web Access setting in the phone configuration profile, which is the default state and prevents exploitation.
Apply access control lists on distribution switches to block HTTP and HTTPS traffic to phone IP ranges from non-administrative sources.
Where central management is used, push a configuration template that enforces Web Access disabled across the phone fleet.

bash

# Configuration example: block HTTP/HTTPS to the voice VLAN from user subnets
ip access-list extended DENY-USER-TO-PHONE-WEB
 deny tcp 10.10.0.0 0.0.255.255 10.20.0.0 0.0.255.255 eq 80
 deny tcp 10.10.0.0 0.0.255.255 10.20.0.0 0.0.255.255 eq 443
 permit ip any any
!
interface Vlan10
 ip access-group DENY-USER-TO-PHONE-WEB in