Cisco Security Updates 02 March 2023

The severity of the addressed vulnerabilities could allow the remote attacker to gain access, obtain information, cause a denial of service, and trigger Cross-site Scripting (XSS) or server-side request forgery (SSRF) attacks on the affected products.

Sample of the addressed vulnerabilities:

1. Cisco IP Phone Command Injection Vulnerability (CVE-2023-20078):

• CVSS: 9.8

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: None

• Consequences: Gain Access

2. Cisco IP Phone Denial of Service Vulnerability (CVE-2023-20079):

• CVSS: 7.5

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: None

• Consequences: Denial of Service

Affected Products:

• Cisco IP Phone.

• Cisco Prime Infrastructure.

• Cisco EPN Manager.

• Cisco Unified Intelligence Center.

• Cisco Finesse.

• Cisco Webex.