Cisco IP Phones Information Disclosure Vulnerability

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks.

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

敏感数据的明文存储

Cisco IP Phone 安全漏洞

Cisco IP Phone是美国思科（Cisco）公司的一个硬件设备。提供通话功能的IP电话。 Cisco IP Phones 存在安全漏洞，该漏洞源于受影响设备上的机密信息未加密存储造成的。攻击者可以通过物理提取和访问其中一个闪存芯片来利用此漏洞。成功的利用可能允许攻击者从设备获取机密信息，这些信息可用于后续攻击。

N/A

N/A