Cisco Security Updates – 08 August 2024

The addressed vulnerabilities could allow the remote attacker to perform denial of service attacks, conduct cross-site scripting attacks, bypass security restrictions, or execute arbitrary commands at the root privilege level and gain access to the affected system by sending specially crafted HTTP packets.

Sample of the addressed vulnerabilities:

1. Cisco Small Business SPA300 Series and SPA500 Series IP Phones Buffer Overflow Vulnerability (CVE-2024-20450):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. Cisco Small Business SPA300 Series and SPA500 Series IP Phones Denial of Service Vulnerability (CVE-2024-20451):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

Sample of the affected products:

• Cisco Small Business SPA300 Series and Cisco Small Business SPA500 Series IP Phones.
• Cisco IOS XR Software Network Convergence System (NCS) 540 Series Routers.
• Cisco IOS XR Software 8000 Series Routers.
• Cisco ISE.