PT-2017-12480 · Cisco · Cisco Ip Phone 8800 Series

Publicado 2017-11-16 · Atualizado 2019-10-09 · CVE-2017-12305

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 8800 series (affected versions not specified)

Description A vulnerability in the debug interface could allow an authenticated, local attacker to execute arbitrary commands due to insufficient input validation. An attacker could exploit this by authenticating to the device and submitting additional command input to the affected parameter in the debug shell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2017-12305

Produtos afetados

Cisco Ip Phone 8800 Series

Referências · 4

• http://securityfocus.com/bid/101869 · Nota
• http://securitytracker.com/id/1039829 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ipp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12305 · Nota de Segurança