CVE-2017-12305

6.7MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco Ip Phone 8800 Series
Vendor
CVE Published:
16 November 2017

Summary

A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug Shell Command Injection. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting additional command input to the affected parameter in the debug shell. Cisco Bug IDs: CSCvf80034.

Affected Version(s)

Cisco IP Phone 8800 Series Cisco IP Phone 8800 Series

References

http://www.securitytracker.com/id/1039829
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/101869
vdb-entryx_refsource_BID
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.