"Cisco Discloses High-Severity IP Phone Bug With Exploit Code"

Cisco has disclosed a critical vulnerability that could enable Remote Code Execution (RCE) and Denial-of-Service (DoS) attacks on its latest generation of IP phones. The company warned that its Product Security Incident Response Team (PSIRT) is aware of the availability of proof-of-concept (POC) exploit code and that the vulnerability has been publicly discussed. However, according to Cisco's PSIRT, it is not aware of any attempts to exploit this flaw in attacks. Cisco did not release security updates to address this bug prior to its public disclosure, but says a patch will be available in January 2023. The security flaw, tracked as CVE-2022-20968, is caused by insufficient input validation of received Cisco Discovery Protocol packets, which unauthenticated, adjacent attackers can exploit to cause a stack overflow. The bug impacts Cisco IP phones running firmware versions 14.2 and earlier. While no security update or workaround for the flaw is currently available, Cisco provides mitigation advice for administrators who want to protect vulnerable devices in their environment from potential attacks. Disabling the Cisco Discovery Protocol on affected IP Phone 7800 and 8800 Series devices that also support Link Layer Discovery Protocol (LLDP) for neighbor discovery is required. According to Cisco's security advisory, devices will then use LLDP to discover configuration data such as voice VLAN and power negotiation. This article continues to discuss the high-severity vulnerability impacting Cisco IP phones.

Bleeping Computer reports "Cisco Discloses High-Severity IP Phone Bug With Exploit Code"