PT-2017-12480 · Cisco · Cisco Ip Phone 8800 Series

Published 2017-11-16 · Updated 2019-10-09 · CVE-2017-12305

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 8800 series (affected versions not specified)

Description A vulnerability in the debug interface could allow an authenticated, local attacker to execute arbitrary commands due to insufficient input validation. An attacker could exploit this by authenticating to the device and submitting additional command input to the affected parameter in the debug shell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2017-12305

Affected Products

Cisco Ip Phone 8800 Series

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ipp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12305 · Security Note
• http://securityfocus.com/bid/101869 · Note
• http://securitytracker.com/id/1039829 · Note