Zack Sanchez

Name of the Vulnerable Software and Affected Versions: Cisco ATA 190 Series Analog Telephone Adapter (affected versions not specified) Description: The issue is related to a vulnerability in the web-based management interface of the Cisco ATA 190 Series Analog Telephone Adapter firmware. This vulnerability allows an unauthenticated, remote attacker to modify the configuration or reboot an affected device by sending a malicious request to the web-based management interface. The vulnerability is due to the HTTP server allowing state changes in GET requests, which could result in a denial of service (DoS) condition. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cisco ATA 190 Series Analog Telephone Adapter firmware (affected versions not specified) Description: A vulnerability in the web-based management interface of the Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device. This vulnerability is due to a lack of authentication on specific HTTP endpoints. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view or delete the configuration or change the firmware. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone versions prior to the fixed version **Description** Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is related to the possibility of command injection, which may allow a remote attacker to execute arbitrary code with root privileges. **Recommendations** For Cisco IP Phone 6800, 7800, 7900, and 8800 Series products, update to the latest security patch released by Cisco to fix the critical vulnerability. As a temporary workaround, consider restricting access to the web-based management interface until a patch is applied. Avoid using the vulnerable web-based management interface until the issue is resolved. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Cisco IP Phone 6800 versions (affected versions not specified) Cisco IP Phone 7800 versions (affected versions not specified) Cisco IP Phone 8800 versions (affected versions not specified) **Description** The issue is related to the web-based management interface of certain Cisco IP Phones, which could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. This could lead to a disruption in service. **Recommendations** For Cisco IP Phone 6800, update to a version that addresses the vulnerability. For Cisco IP Phone 7800, update to a version that addresses the vulnerability. For Cisco IP Phone 8800, update to a version that addresses the vulnerability. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.