Sign-up

ID

VAR-202206-1233


CVE

CVE-2022-20817


TITLE

Cisco Unified IP Phones  Cryptographic weakness in  PRNG  Vulnerability regarding the use of

Trust: 0.8

sources: JVNDB: JVNDB-2022-011605

DESCRIPTION

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability

Trust: 2.25

sources: NVD: CVE-2022-20817 // JVNDB: JVNDB-2022-011605 // CNVD: CNVD-2022-55668 // VULMON: CVE-2022-20817

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-55668

AFFECTED PRODUCTS

vendor:ciscomodel:unified ip phone 6961scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 6945scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 9971scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 6921scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:ata 187 analog telephone adapterscope:eqversion:*

Trust: 1.0

vendor:ciscomodel:unified ip phone 6941scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 8961scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 8945scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 6911scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 9951scope:eqversion: -

Trust: 1.0

vendor:ciscomodel:unified ip phone 8941scope:eqversion: -

Trust: 1.0

vendor:シスコシステムズmodel:cisco unified ip phone 8945scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 6911scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 9971scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 6941scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 6945scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 9951scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 8961scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 6961scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 6921scope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco unified ip phone 8941scope: - version: -

Trust: 0.8

vendor:ciscomodel:unified ip phonescope:eqversion:8945

Trust: 0.6

vendor:ciscomodel:ata analog telephone adapterscope:eqversion:187

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:6911

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:6921

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:6941

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:6945

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:6961

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:8941

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:8961

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:9951

Trust: 0.6

vendor:ciscomodel:unified ip phonescope:eqversion:9971

Trust: 0.6

sources: CNVD: CNVD-2022-55668 // JVNDB: JVNDB-2022-011605 // NVD: CVE-2022-20817

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20817
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20817
value: HIGH

Trust: 1.0

NVD: CVE-2022-20817
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-55668
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202206-1534
value: HIGH

Trust: 0.6

VULMON: CVE-2022-20817
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-20817
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-55668
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-20817
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 5.2
version: 3.1

Trust: 2.0

NVD: CVE-2022-20817
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-55668 // VULMON: CVE-2022-20817 // JVNDB: JVNDB-2022-011605 // CNNVD: CNNVD-202206-1534 // NVD: CVE-2022-20817 // NVD: CVE-2022-20817

PROBLEMTYPE DATA

problemtype:CWE-338

Trust: 1.0

problemtype:Cryptographic weakness PRNG Use of (CWE-338) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-011605 // NVD: CVE-2022-20817

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202206-1534

TYPE

security feature problem

Trust: 0.6

sources: CNNVD: CNNVD-202206-1534

PATCH

title:cisco-sa-cp6901-dup-cert-82jdJGe4url:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4

Trust: 0.8

title:Patch for Cisco Unified IP Phones Security Feature Issue Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/340046

Trust: 0.6

title:Cisco Unified IP Phones Fixing measures for security feature vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=196353

Trust: 0.6

title:Cisco: Cisco IP Phone Duplicate Key Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-cp6901-dup-cert-82jdJGe4

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: CNVD: CNVD-2022-55668 // VULMON: CVE-2022-20817 // JVNDB: JVNDB-2022-011605 // CNNVD: CNNVD-202206-1534

EXTERNAL IDS

db:NVDid:CVE-2022-20817

Trust: 3.9

db:JVNDBid:JVNDB-2022-011605

Trust: 0.8

db:CNVDid:CNVD-2022-55668

Trust: 0.6

db:CNNVDid:CNNVD-202206-1534

Trust: 0.6

db:VULMONid:CVE-2022-20817

Trust: 0.1

sources: CNVD: CNVD-2022-55668 // VULMON: CVE-2022-20817 // JVNDB: JVNDB-2022-011605 // CNNVD: CNNVD-202206-1534 // NVD: CVE-2022-20817

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cp6901-dup-cert-82jdjge4

Trust: 3.0

url:https://nvd.nist.gov/vuln/detail/cve-2022-20817

Trust: 0.8

url:https://vigilance.fr/vulnerability/cisco-ip-phone-privilege-escalation-via-duplicate-key-38606

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-20817/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/338.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: CNVD: CNVD-2022-55668 // VULMON: CVE-2022-20817 // JVNDB: JVNDB-2022-011605 // CNNVD: CNNVD-202206-1534 // NVD: CVE-2022-20817

SOURCES

db:CNVDid:CNVD-2022-55668
db:VULMONid:CVE-2022-20817
db:JVNDBid:JVNDB-2022-011605
db:CNNVDid:CNNVD-202206-1534
db:NVDid:CVE-2022-20817

LAST UPDATE DATE

2024-11-23T22:50:46.529000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-55668date:2022-08-08T00:00:00
db:VULMONid:CVE-2022-20817date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2022-011605date:2023-08-23T05:06:00
db:CNNVDid:CNNVD-202206-1534date:2022-06-30T00:00:00
db:NVDid:CVE-2022-20817date:2024-11-21T06:43:36.787

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-55668date:2022-08-08T00:00:00
db:VULMONid:CVE-2022-20817date:2022-06-15T00:00:00
db:JVNDBid:JVNDB-2022-011605date:2023-08-23T00:00:00
db:CNNVDid:CNNVD-202206-1534date:2022-06-15T00:00:00
db:NVDid:CVE-2022-20817date:2022-06-15T18:15:08.997