PEN Consultants Logo
Don’t Be a Victim: Find your weaknesses before the criminals do. PEN Consultants can help!

Mass Call Record Collection – Cisco IP Phones

This article will demonstrate how to perform a mass collection of all phone records in an enterprise from many popular series of Cisco IP Phones and how to prevent it.

Many of the Cisco IP Phone series have a built-in web server that allows users and admins to “view the phone statistics and modify some or all the parameters”. In most modern phone series, Cisco has this web server disabled by default to “enhance security”. For those that are enabled, either by default or through a configuration change (ex. via CUCM or the phone), there is a certain level of access that is allowed without authentication.

cisco7962 | PEN Consultants

To see a few live examples, Google: “Cisco Unified IP Phone” “Console Logs” “Current Logs In”. Note: use all three quoted phrases, after the colon, in your search and 100% of the results will be publicly accessible Cisco IP Phones.

Another example Google search: inurl:”/CGI/Java/Serviceability”.

In our experience, it is common to see this embedded web server enabled on not only Cisco IP phones, but also other brands of IP Phones.

“So what? What’s the danger?” you may ask.

There is a wealth of data that can typically be seen through these embedded web interfaces – phone number, user’s name, various system debug logs, etc. Within the debug logs, such as the Console Logs, are various system details as well as call record details.

cisco9218 2 1024x707 1 | PEN Consultants
cisco8840 | PEN Consultants

Inside those console logs, we can see SIP/call records (ex. phones numbers and date):

| PEN Consultants

Red Team

During certain engagements, PEN Consultants has the need to collect all accessible console logs across an enterprise and parse out each unique phone call record in order to demonstrate the impact of these open web interfaces. To automate the process, we created a simple script, which allows us to collect thousands of call records from hundreds of phones in just a few minutes.

We are making that script publicly available for other security professionals to use during their engagements:

ciscoIPhoneResults 2 2 | PEN Consultants
ciscoIPhoneResults | PEN Consultants

We will continue to expand on this script during future engagements in order to collect internal user names, caller ID, call length, etc.

Blue Team

Ensure the configuration options that Cisco provides are securely configured:

Featured image is a derivative work from the following images: ElasticComputeFarm @

If you are looking for a reliable and experienced offensive security service that provides Rock Solid Security, look no further than PEN Consultants for all your information and cybersecurity testing needs. Contact us: