CVSS: 6.8EPSS: 0%CPEs: 37EXPL: 0CVE-2024-20391
https://notcve.org/view.php?id=CVE-2024-20391
A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected device to elevate privileges to SYSTEM. This vulnerability is due to a lack of authentication on a specific function. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges on an affected device. Una vulnerabilidad en el módulo Network Access Manager (NAM) de Cisco Secure Client podría permitir que un atacante no autenticado con acceso físico a un dispositivo afectado eleve privilegios al SYSTEM. Esta vulnerabilidad se debe a la falta de autenticación en una función específica. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario con privilegios de SYSTEM en un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-nam-priv-esc-szu2vYpZ • CWE-306: Missing Authentication for Critical Function •
CVSS: 4.7EPSS: 0%CPEs: 93EXPL: 0CVE-2024-20369
https://notcve.org/view.php?id=CVE-2024-20369
A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of a parameter in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. Una vulnerabilidad en la interfaz de administración basada en web de Cisco Crosswork Network Services Orchestrator (NSO) podría permitir que un atacante remoto no autenticado redirija a un usuario a una página web maliciosa. Esta vulnerabilidad se debe a una validación de entrada incorrecta de un parámetro en una solicitud HTTP. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-ordir-MNM8YqzO • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2024-20376
https://notcve.org/view.php?id=CVE-2024-20376
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the affected device to reload. Una vulnerabilidad en la interfaz de administración basada en web del firmware del teléfono IP de Cisco podría permitir que un atacante remoto no autenticado provoque la recarga de un dispositivo afectado, lo que resultaría en una condición DoS. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2024-20378
https://notcve.org/view.php?id=CVE-2024-20378
A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to a lack of authentication for specific endpoints of the web-based management interface on an affected device. An attacker could exploit this vulnerability by connecting to the affected device. A successful exploit could allow the attacker to gain unauthorized access to the device, enabling the recording of user credentials and traffic to and from the affected device, including VoIP calls that could be replayed. Una vulnerabilidad en la interfaz de administración basada en web del firmware del teléfono IP de Cisco podría permitir que un atacante remoto no autenticado recupere información confidencial de un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS • CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 5.9EPSS: 0%CPEs: 30EXPL: 0CVE-2024-20357
https://notcve.org/view.php?id=CVE-2024-20357
A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an affected device. This vulnerability exists because bounds-checking does not occur while parsing XML requests. An attacker could exploit this vulnerability by sending a crafted XML request to an affected device. A successful exploit could allow the attacker to initiate calls or play sounds on the device. Una vulnerabilidad en el servicio XML del firmware del teléfono IP de Cisco podría permitir que un atacante remoto no autenticado inicie llamadas telefónicas en un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-multi-vulns-cXAhCvS • CWE-787: Out-of-bounds Write •