Cisco IP Phones Duplicate Key (CVE-2022-20817)

high Tenable OT Security Plugin ID 502106

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode.
This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone.
This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

Plugin Details

Severity: High

ID: 502106

Version: 1.1

Type: remote

Family: Tenable.ot

Published: 3/18/2024

Updated: 3/18/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2022-20817

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:unified_ip_phone_8945_firmware:-, cpe:/o:cisco:unified_ip_phone_8961_firmware:-, cpe:/o:cisco:unified_ip_phone_6911_firmware:-, cpe:/o:cisco:unified_ip_phone_6945_firmware:-, cpe:/o:cisco:unified_ip_phone_6941_firmware:-, cpe:/o:cisco:unified_ip_phone_8941_firmware:-, cpe:/o:cisco:unified_ip_phone_6921_firmware:-, cpe:/o:cisco:unified_ip_phone_9951_firmware:-, cpe:/o:cisco:unified_ip_phone_9971_firmware:-, cpe:/o:cisco:unified_ip_phone_6961_firmware:-

Required KB Items: Tenable.ot/Cisco

Exploit Ease: No known exploits are available

Patch Publication Date: 6/15/2022

Vulnerability Publication Date: 6/15/2022

Reference Information

CVE: CVE-2022-20817

CWE: 338

Detections

Analytics