PT-2021-3791 · Cisco · Cisco Ip Phone Series 8800

Ang Cui + 2 · Published 2021-07-07 · Updated 2021-08-02 · CVE-2021-33478

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IP Phone series 8800 versions prior to 2021-07-07

Description The issue is related to the implementation of the TrustZone technology in the microprogram software of Cisco IP Phone series 8800. It is caused by a lack of mechanism for checking the size of copied data. An unauthenticated, physically proximate attacker could achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. Exploitation is possible only when the attacker can disassemble the device to control the voltage/current for chip pins.

Recommendations For versions prior to 2021-07-07, update the firmware to a version released after 2021-07-07 to resolve the issue. As a temporary workaround, consider restricting physical access to the device to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

BDU:2021-04066

CVE-2021-33478

Affected Products

Cisco Ip Phone Series 8800

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-33478 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-brcm-mxc-jul2021-26LqUZUh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33478 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04066 · Security Note
• https://t.me/cvenotify/18478 · Telegram Post
• https://t.me/cibsecurity/26402 · Telegram Post
• https://securitylab.ru/vulnerability/522047.php · Note
• https://cybersecurity-help.cz/vdb/SB2021070816 · Note