Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco ip conference phone 7832 firmwarebefore 12.8\(1\)
• cisco ip conference phone 7832 firmware12.8(1)
• cisco ip conference phone 7832 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip conference phone 8832 firmwarebefore 12.8\(1\)
• cisco ip conference phone 8832 firmware12.8(1)
• cisco ip conference phone 8832 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 6821 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 6841 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 6851 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 6861 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 6871 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 7811 firmwarebefore 12.8\(1\)
• cisco ip phone 7811 firmware12.8(1)
• cisco ip phone 7811 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 7821 firmwarebefore 12.8\(1\)
• cisco ip phone 7821 firmware12.8(1)
• cisco ip phone 7821 with multiplatform firmwarebefore 11.3\(2\)
• cisco ip phone 7841 firmwarebefore 12.8\(1\)
• cisco ip phone 7841 firmware12.8(1)
• cisco ip phone 7841 with multiplatform firmwarebefore 11.3\(2\)

Versions reported by the vendor

Affected version ranges reported by the assigning authority (cisco). Independent of NVD's CPE analysis and usually ahead of it.

• Cisco Cisco IP Phones with Multiplatform Firmware

  • 11.1.2, 11.2.1, 11.2.3, 11.2.2, 11.2.3 MSR1-1, 11.1.2 MSR1-1, 11.1.1, 11.1.2 MSR3-1, 11.0.0, 11.1.1 MSR1-1, 11.0.1, 11.1.1 MSR2-1 … (+8)affected

• Cisco Cisco Session Initiation Protocol (SIP) Software

  • 9.0(3), 9.0(2)SR2, 9.0(2)SR1, 9.2(1), 9.4(2)SR1, 9.4(2), 9.4(2)SR2, 9.4(2)SR3, 9.3(1)SR2, 9.3(1)SR3, 9.3(1)SR1, 9.1(1)SR1 … (+28)affected

• Cisco Cisco Small Business IP Phones

  • 7.4.8, 7.4.3, 7.5.5a, 7.3.7, 7.5.2, 7.5.1, 7.4.6, 7.5.7, 7.4.4, 7.6.2SR3, 7.6.2, 7.5.6 … (+20)affected

Other highest-scoring records for the same primary product.

• CVE-2020-3111Cisco IP Phone Remote Code Execution and Denial of Service Vulnerability
  36Monitor
• CVE-2019-1635Cisco IP Phone 7800 Series and 8800 Series Session Initiation Protocol XML Denial of Service Vulnerability
  31Monitor
• CVE-2019-1922Cisco IP Phone 7800 and 8800 Series Session Initiation Protocol Denial of Service Vulnerability
  30Monitor
• CVE-2021-34711Cisco IP Phone Software Arbitrary File Read Vulnerability
  22Monitor
• CVE-2022-20660Cisco IP Phones Information Disclosure Vulnerability
  18Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.