CVE-2021-34711
Assigner: cisco
Published: 2021-10-06T00:00:00
State: PUBLISHED
affected: product: Cisco IP Phones with Multiplatform Firmware 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-10-06T00:00:00
descriptions: value: A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug shell command. A successful exploit could allow the attacker to read any file on the device file system.
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-36
description: CWE-36
type: CWE
source: advisory: cisco-sa-ipphone-arbfileread-NPdtE2Ow
defect: CSCvx85812
CSCvx85813
CSCvx85818
CSCvx85820
CSCvx85821
CSCvx85822
CSCvx85824
discovery: INTERNAL
title: Cisco IP Phone Software Arbitrary File Read Vulnerability