CVE-2015-0604: Input Validation
Published Feb 7, 2015
·Updated
The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424.
Affected Software
4 affected components
Cisco Unified Ip Phones 9971 Firmware=9.4\(.1\)
Cisco Unified Ip Phone 9971
Cisco Unified Ip Phones 9951 Firmware=9.4\(.1\)
Cisco Unified Ip Phone 9951
Event History
Feb 7, 2015
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0604?
CVE-2015-0604 is considered to have a medium severity due to the risk of unauthorized file uploads.
2
How do I fix CVE-2015-0604?
To mitigate CVE-2015-0604, update the firmware of Cisco Unified IP 9900 phones to a version later than 9.4(1).
3
What are the affected devices for CVE-2015-0604?
CVE-2015-0604 affects Cisco Unified IP Phones 9951 and 9971 running firmware version 9.4(1) or earlier.
4
What kind of attack does CVE-2015-0604 allow?
CVE-2015-0604 allows remote attackers to upload files to arbitrary locations on the phone's filesystem.
5
Who reported CVE-2015-0604?
CVE-2015-0604 was reported as Bug ID CSCup90424 by Cisco security teams.