CVE-2022-20660 [Medium] | Information Disclosure in Ip Conference Phone 7832 …

A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidential information from an affected device. This vulnerability is due to unencrypted storage of confidential information on an affected device. An attacker could exploit this vulnerability by physically extracting and accessing one of the flash memory chips. A successful exploit could allow the attacker to obtain confidential information from the device, which could be used for subsequent attacks.

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

—

nvd_ref

exploit_tag

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.08%	0.35%	+0.27%
2	2023-03-07	0.95%	0.08%	-0.87%
3	2022-02-08	—	0.95%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.08%

0.35%

+0.27%

2023-03-07

0.95%

0.08%

-0.87%

2022-02-08

—

0.95%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.6	3.1	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` Click to expand Attack vector (AV:P) Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	0.9	3.6	[email protected]
4.6	3.1	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` Click to expand Attack vector (AV:P) Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	0.9	3.6	[email protected]
2.1	2.0	LOW	`AV:L/AC:L/Au:N/C:P/I:N/A:N` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:N) No availability impact.	3.9	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.6

3.1

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Click to expand

Attack vector (AV:P): Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

0.9

3.6

[email protected]

4.6

3.1

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Click to expand

Attack vector (AV:P): Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

0.9

3.6

[email protected]

2.1

2.0

LOW

AV:L/AC:L/Au:N/C:P/I:N/A:N Click to expand

Access vector (AV:L): Requires local access to the target system.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:N): No availability impact.

3.9

2.9

[email protected]

Affected software / configurations for CVE-2022-20660

Vendor	Product	Version	Raw CPE
cisco	ip_conference_phone_7832_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_conference_phone_7832_firmware::::::::
cisco	ip_conference_phone_8832_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_conference_phone_8832_firmware::::::::
cisco	ip_phone_7811_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_7811_firmware::::::::
cisco	ip_phone_7821_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_7821_firmware::::::::
cisco	ip_phone_7841_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_7841_firmware::::::::
cisco	ip_phone_7861_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_7861_firmware::::::::
cisco	ip_phone_8811_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_8811_firmware::::::::
cisco	ip_phone_8841_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_8841_firmware::::::::
cisco	ip_phone_8845_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_8845_firmware::::::::
cisco	ip_phone_8851_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_8851_firmware::::::::
cisco	ip_phone_8861_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_8861_firmware::::::::
cisco	ip_phone_8865_firmware	< 14.1\(1\)	cpe:2.3:o:cisco:ip_phone_8865_firmware::::::::
cisco	unified_ip_conference_phone_8831_firmware	—	cpe:2.3:o:cisco:unified_ip_conference_phone_8831_firmware:-:::::::*
cisco	unified_ip_conference_phone_8831_for_third-party_call_control_firmware	—	cpe:2.3:o:cisco:unified_ip_conference_phone_8831_for_third-party_call_control_firmware:-:::::::*
cisco	unified_ip_phone_7945g_firmware	—	cpe:2.3:o:cisco:unified_ip_phone_7945g_firmware:-:::::::*
cisco	unified_ip_phone_7965g_firmware	—	cpe:2.3:o:cisco:unified_ip_phone_7965g_firmware:-:::::::*
cisco	unified_ip_phone_7975g_firmware	—	cpe:2.3:o:cisco:unified_ip_phone_7975g_firmware:-:::::::*
cisco	unified_sip_phone_3905_firmware	< 9.4\(1\)sr5	cpe:2.3:o:cisco:unified_sip_phone_3905_firmware::::::::
cisco	wireless_ip_phone_8821_firmware	< 11.0\(6\)sr2	cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware::::::::
cisco	wireless_ip_phone_8821-ex_firmware	< 11.0\(6\)sr2	cpe:2.3:o:cisco:wireless_ip_phone_8821-ex_firmware::::::::

References for CVE-2022-20660

URL	Tags
http://packetstormsecurity.com/files/165567/Cisco-IP-Phone-Cleartext-Password-Storage.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2022/Jan/34	Mailing List Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-info-disc-fRdJfOxA	Vendor Advisory

URL

CVE-2022-20660 | Cisco IP Phones Information Disclosure Vulnerability

Public exploit references (Exploit-DB) for CVE-2022-20660

Exploit prediction scoring system (EPSS) score for CVE-2022-20660

Common vulnerability scoring system (CVSS) metrics for CVE-2022-20660

Weakness enumeration for CVE-2022-20660

Affected software / configurations for CVE-2022-20660

References for CVE-2022-20660