PT-2016-4784 · Cisco · Cisco 8800

Publicado 2016-06-23 · Atualizado 2016-11-30 · CVE-2016-1434

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco 8800 phones version 11.0(1)

Description The issue concerns the license-certificate upload functionality, which allows remote authenticated users to delete arbitrary files by uploading an invalid file.

Recommendations For version 11.0(1), consider restricting access to the license-certificate upload functionality until a fix is available. As a temporary workaround, limit the ability of remote authenticated users to upload files to prevent potential exploitation.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-20

CWE-22

Identificadores relacionados

CVE-2016-1434

Produtos afetados

Cisco 8800

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-ip-phone · Aviso do Fabricante
• http://securitytracker.com/id/1036139 · Nota
• https://osv.dev/vulnerability/CVE-2016-1434 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1434 · Nota de Segurança