Cisco IP Phones Web Server Multiple Vulnerabilities

While conducting research on a Cisco Wireless IP Phone 8821, Tenable discovered a couple of vulnerabilities affecting numerous Cisco IP Phone models.

CVE-2020-3161: Unauthenticated Stack-Based Buffer Overflow

An unauthenticated remote attacker can trigger a stack-based buffer overflow by sending a crafted HTTP request to the /deviceconfig/setActivationCode endpoint. In libHTTPService.so, the parameters after /deviceconfig/setActivationCode are used to create a new URI via a sprintf function call. The length of the parameter string is not checked. When an attacker provides a long parameter string then sprintf overflows the provided stack-based buffer. This results in a crash of the device or could potentially allow for remote code execution.

A denial of service proof of concept can be found on our GitHub.

CVE-2016-1421: Unauthenticated Stack-Based Buffer Overflow

An unauthenticated remote attacker can trigger a stack-based buffer overflow by sending a crafted HTTP request to the /CGI/CallInfo endpoint. In libHTTPService.so, the parameters after /CGI/CallInfo are appended to a stack buffer using strcat. The length of the parameter string is not checked. When an attacker provides a long parameter string, strcat overflows the buffer. This results in a crash of the device or could potentially allow for remote code execution.

A denial of service proof of concept can be found on our GitHub.

During Tenable's original analysis, they noted the similarity of this vulnerability to CSCuz03016. However, Cisco's advisory described the vulnerability as requiring authentication, DoS only, and the Wireless IP Phone 8821 wasn't listed on the affected list. After disclosing to Cisco, they informed Tenable that the described bug was CVE-2016-1421 and subsequently updated their disclosure.