PT-2018-8769 · Cisco · Cisco Ip Phone 7800+2

Published 2018-07-16 · Updated 2019-10-09 · CVE-2018-0341

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware versions prior to 11.2(1)

Description The issue is related to insufficient input validation in the web-based UI, allowing an authenticated, remote attacker to perform command injection and execute commands with the privileges of the web server. This can be achieved by including arbitrary shell commands in a specific user input field.

Recommendations For versions prior to 11.2(1), update to version 11.2(1) or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based UI to minimize the risk of exploitation. Avoid using arbitrary shell commands in user input fields until the issue is resolved.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2018-0341

Affected Products

Cisco Ip Phone 6800

Cisco Ip Phone 7800

Cisco Ip Phone 8800

References · 5

• https://osv.dev/vulnerability/CVE-2018-0341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0341 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-phone-webui-inject · Vendor Advisory
• http://securityfocus.com/bid/104731 · Note
• http://securitytracker.com/id/1041285 · Note