CVE-2024-20454
Published: 07 August 2024
Summary
CVE-2024-20454 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Cisco Spa 301 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-20454 is a set of vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series and SPA500 Series IP Phones. The issues stem from insufficient error checking on incoming HTTP packets, which can trigger a buffer overflow condition tracked under CWE-120 and allow code execution on the underlying operating system.
An unauthenticated remote attacker can exploit the flaws by sending a specially crafted HTTP request to an affected device. Successful exploitation grants the ability to overflow an internal buffer and run arbitrary commands with root privileges, corresponding to a CVSS 3.1 score of 9.8.
The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-http-vulns-RJZmX2Xz addresses the issues. The associated EPSS score rose from lower values after disclosure to a peak of 0.2572 on 2025-12-11 before receding to the current 0.1171, indicating a period of increased exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18169
Vulnerability details
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root…
more
privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.