CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 7.5
CWE Name:  Improper Input Validation
Summary: a vulnerability in the web-based management interface of session initiation protocol (sip) software for cisco ip phone 7800 series and cisco ip phone 8800 series could allow an unauthenticated, remote attacker to cause a denial of service (dos) condition or execute arbitrary code. the vulnerability exists because the software improperly validates user-supplied input during user authentication. an attacker could exploit this vulnerability by connecting to an affected device using http and supplying malicious user credentials. a successful exploit could allow the attacker to trigger a reload of an affected device, resulting in a dos condition, or to execute arbitrary code with the privileges of the app user. cisco fixed this vulnerability in the following sip software releases: 10.3(1)sr5 and later for cisco unified ip conference phone 8831; 11.0(4)sr3 and later for cisco wireless ip phone 8821 and 8821-ex; and 12.5(1)sr1 and later for the rest of the cisco ip phone 7800 series and 8800 series.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-03-22
Last Modified Date: 2019-10-09