CVE-2020-3111:

Cisco IP Phone Cisco Discovery Protocol Remote Code Execution Vulnerability

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Feb 5, 2020
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.2
EPSS Percentile:46%

Exploitability

Score:2.8
Attack Vector:ADJACENT_NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Cisco IP Phone Cisco Discovery Protocol Remote Code Execution Vulnerability

Overview

This vulnerability affects the Cisco Discovery Protocol implementation in Cisco IP Phones. Due to insufficient input validation (CWE-20: Improper Input Validation), an adjacent attacker can send specially crafted CDP packets to an affected device. Since CDP is a Layer 2 protocol, the attacker must be in the same broadcast domain as the target device. The vulnerability can be exploited in two ways: 1. Remote code execution with root privileges, giving attackers complete control over the device 2. Causing the device to reload, resulting in a denial of service condition This issue is particularly severe because it requires no authentication and can lead to complete device compromise. The attack vector requires only Layer 2 adjacency, making it exploitable by any attacker who can connect to the same network segment as the vulnerable phones.

Remediation

To address this vulnerability, network administrators should:
1. Update affected Cisco IP Phones to the latest firmware versions that contain fixes for this vulnerability. Refer to the Cisco Security Advisory for specific version information.
2. If immediate patching is not possible, consider these mitigations:
Disable CDP on IP Phones where feasible
Implement network segmentation to limit Layer 2 access to IP Phones
Monitor network traffic for suspicious CDP packets
Implement strict physical security controls to prevent unauthorized network access
3. Verify successful remediation by checking firmware versions on all deployed IP Phones.