CVE Catalog
CVE-2026-5923
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
The vulnerability allows malicious use of a stolen cookie to modify the contents of the IP phone's webpage.
Risk Assessment
An attacker can hijack an administrator session and alter the IP phone configuration, potentially leading to eavesdropping or service disruption.
Recommendation
Immediately enforce session cookie rotation and implement cookie theft protection mechanisms such as HttpOnly and Secure flags.
Other vulnerabilities in IP Phone
Original NVD description (English source)
Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS