Cisco warns of critical RCE zero-days in end of life IP phones

Cisco disclosed five vulnerabilities in the web management interface of end-of-life SPA 300 and SPA 500 series IP phones — three critical unauthenticated remote-code-execution buffer overflows (CVE-2024-20450, CVE-2024-20452, CVE-2024-20454) and two high-severity denial-of-service flaws (CVE-2024-20451, CVE-2024-20453). Because these products are out of support and no fixes are available, Cisco recommends migrating to newer supported models and using the vendor's migration programs or contacting TAC for options.