CVE-2022-20817
mediumpriority · track · 30EPSS 0.012 · 68 %ileEURUUSEPSS · scored 2026-10-27
A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCisco IP Phones with Multiplatform Firmwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco IP Phones with Multiplatform Firmwarecisco_csaf
There is a workaround that addresses this vulnerability. As a workaround for this vulnerability, install a Locally Significant Certificate (LSC): Verify that the CUCM certificate is up to date. Open the phone configuration page. Navigate to Settings > Security Configuration > LSC. Install the LSC. See Configure LSC on Cisco IP Phone with CUCM ["https://www.cisco.com/c/en/us/support/docs/content-networking/certificates/213295-how-to-install-an-lsc-on-a-cisco-ip-phon.html"] for more details.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4–7.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (25)
Products and version ranges known to be affected.
- cisco ata 187 analog telephone adapter firmwareall versionsnvdUScpe:2.3:o:cisco:ata_187_analog_telephone_adapter_firmware:*:*:*:*:*:*:*:*
- cisco unified ip phone 6911 firmwareall versionsnvdUScpe:2.3:o:cisco:unified_ip_phone_6911_firmware:*:*:*:*:*:*:*:*
- cisco unified ip phone 6921 firmwareall versionsnvdUScpe:2.3:o:cisco:unified_ip_phone_6921_firmware:*:*:*:*:*:*:*:*
- cisco unified ip phone 6941 firmwareall versionsnvdUScpe:2.3:o:cisco:unified_ip_phone_6941_firmware:*:*:*:*:*:*:*:*
- cisco unified ip phone 6945 firmwareall versionsnvdUScpe:2.3:o:cisco:unified_ip_phone_6945_firmware:*:*:*:*:*:*:*:*
- cisco unified ip phone 6961 firmwareall versionsnvdUScpe:2.3:o:cisco:unified_ip_phone_6961_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- cisco-sa-cp6901-dup-cert-82jdJGe4Cisco IP Phone Duplicate Key Vulnerability2022-06-15csaf · cisco_csafUS
A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4"]
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-20817/cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4cnnvd
- https://vigilance.fr/vulnerability/Cisco-IP-Phone-privilege-escalation-via-Duplicate-Key-38606cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4enisa_euvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan