CVE-2024-20450
Published: 07 August 2024
Summary
CVE-2024-20450 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Cisco Spa 301 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-20450 affects the web-based management interface of Cisco Small Business SPA300 Series and SPA500 Series IP Phones. Multiple buffer overflow conditions exist because the interface does not properly validate incoming HTTP packets for errors. Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary commands on the underlying operating system with root privileges.
An attacker can trigger the flaw by sending a single crafted HTTP request to an exposed management interface. No authentication or user interaction is required, and the attack can be performed over the network with low complexity, consistent with the CVSS 9.8 rating.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz describes the issues and provides mitigation guidance, including software updates that address the packet-validation errors.
EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.2572 on 2025-12-11 before settling at the current value of 0.2293, indicating increased exploitation interest well after the initial publication date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18165
Vulnerability details
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root…
more
privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.