CVE-2022-20817

Cisco IP Phone Duplicate Key Vulnerability

Severity Score

7.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.

Una vulnerabilidad en los teléfonos IP de Cisco Unified podría permitir a un atacante remoto no autenticado hacerse pasar por el teléfono de otro usuario si Cisco Unified Communications Manager (CUCM) está en modo seguro. Esta vulnerabilidad es debido a la generación inapropiada de claves durante el proceso de fabricación que podría resultar en claves fabricadas duplicadas instaladas en varios dispositivos. Un atacante podría aprovechar esta vulnerabilidad al llevar a cabo un ataque de máquina en el medio en la comunicación segura entre el teléfono y el CUCM. Una explotación con éxito podría permitir al atacante hacerse pasar por el teléfono de otro usuario. Esta vulnerabilidad no puede abordarse con actualizaciones de software. Se presenta una mitigación que aborda esta vulnerabilidad

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2021-11-02 CVE Reserved
2022-06-15 CVE Published
2024-09-06 EPSS Updated
2024-11-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	Unified Ip Phone 6911 Firmware Search vendor "Cisco" for product "Unified Ip Phone 6911 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 6911 Search vendor "Cisco" for product "Unified Ip Phone 6911"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 6921 Firmware Search vendor "Cisco" for product "Unified Ip Phone 6921 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 6921 Search vendor "Cisco" for product "Unified Ip Phone 6921"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 6941 Firmware Search vendor "Cisco" for product "Unified Ip Phone 6941 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 6941 Search vendor "Cisco" for product "Unified Ip Phone 6941"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 6945 Firmware Search vendor "Cisco" for product "Unified Ip Phone 6945 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 6945 Search vendor "Cisco" for product "Unified Ip Phone 6945"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 6961 Firmware Search vendor "Cisco" for product "Unified Ip Phone 6961 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 6961 Search vendor "Cisco" for product "Unified Ip Phone 6961"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 8941 Firmware Search vendor "Cisco" for product "Unified Ip Phone 8941 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 8941 Search vendor "Cisco" for product "Unified Ip Phone 8941"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 8945 Firmware Search vendor "Cisco" for product "Unified Ip Phone 8945 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 8945 Search vendor "Cisco" for product "Unified Ip Phone 8945"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 8961 Firmware Search vendor "Cisco" for product "Unified Ip Phone 8961 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 8961 Search vendor "Cisco" for product "Unified Ip Phone 8961"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 9951 Firmware Search vendor "Cisco" for product "Unified Ip Phone 9951 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 9951 Search vendor "Cisco" for product "Unified Ip Phone 9951"	-	-	Safe
Cisco Search vendor "Cisco"	Unified Ip Phone 9971 Firmware Search vendor "Cisco" for product "Unified Ip Phone 9971 Firmware"	-	-	Affected	in	Cisco Search vendor "Cisco"	Unified Ip Phone 9971 Search vendor "Cisco" for product "Unified Ip Phone 9971"	-	-	Safe
Cisco Search vendor "Cisco"	Ata 187 Analog Telephone Adapter Firmware Search vendor "Cisco" for product "Ata 187 Analog Telephone Adapter Firmware"	*	-	Affected	in	Cisco Search vendor "Cisco"	Ata 187 Analog Telephone Adapter Search vendor "Cisco" for product "Ata 187 Analog Telephone Adapter"	-	-	Safe