Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20450 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Cisco Spa 301 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-20450 affects the web-based management interface of Cisco Small Business SPA300 Series and SPA500 Series IP Phones. Multiple buffer overflow conditions exist because the interface does not properly validate incoming HTTP packets for errors. Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary commands on the underlying operating system with root privileges.
An attacker can trigger the flaw by sending a single crafted HTTP request to an exposed management interface. No authentication or user interaction is required, and the attack can be performed over the network with low complexity, consistent with the CVSS 9.8 rating.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz describes the issues and provides mitigation guidance, including software updates that address the packet-validation errors.
EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.2572 on 2025-12-11 before settling at the current value of 0.2293, indicating increased exploitation interest well after the initial publication date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18165
Vulnerability Data
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root…
more
privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and analysis can find missing size checks before deployment.
Input validation directly enforces size checks before buffer copies.
Engineering principles require bounds checking and safe buffer handling in design.
Memory protection limits the impact of an overflow once it occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes such as code review or scanning detect classic buffer overflows before exploitation.
Routine patching replaces vulnerable code containing unchecked buffer copies with corrected versions.
Secure development practices directly enforce bounds checking and input validation that prevent classic buffer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.