CVE-2023-20078

Deeper analysis

Multiple vulnerabilities affect the web-based management interface of certain Cisco IP Phones, with the issues rooted in stack-based buffer overflows and out-of-bounds writes as indicated by the associated CWEs. These flaws enable unauthenticated remote attackers to trigger arbitrary code execution or denial-of-service conditions on the affected devices, reflected in the critical CVSS 9.8 score with network attack vector and no required privileges or user interaction.

An unauthenticated remote attacker can send specially crafted requests to the exposed web interface to achieve full code execution or crash the phone, compromising both confidentiality and availability without any prior authentication.

The official Cisco Security Advisory at the referenced URL details the affected phone models and available software updates that address the command injection and memory safety issues. The EPSS score rose materially from low values after disclosure to a peak of 0.2010 on 2025-12-11 before receding, indicating that exploitation interest emerged well after the initial publication and warrants renewed attention.