Cisco Unified SIP Phone 3905 Firmware vulnerabilities

2 CVEs affecting Cisco Unified SIP Phone 3905 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20265, published 2023-11-21.

More from Cisco.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-20265, published 2023-11-21. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against…
• CVE-2022-20660, published 2022-01-14. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device.…