What is the severity of cisco-sa-20190320-ip-phone-rce?

The severity of cisco-sa-20190320-ip-phone-rce is high, as it can lead to denial of service or arbitrary code execution.

How do I fix cisco-sa-20190320-ip-phone-rce?

To fix cisco-sa-20190320-ip-phone-rce, you need to update the firmware of the affected Cisco IP Phone models to the latest version.

What products are affected by cisco-sa-20190320-ip-phone-rce?

The affected products by cisco-sa-20190320-ip-phone-rce are the Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series.

Can cisco-sa-20190320-ip-phone-rce be exploited remotely?

Yes, cisco-sa-20190320-ip-phone-rce can be exploited by an unauthenticated remote attacker.

What kind of attacks can be performed using cisco-sa-20190320-ip-phone-rce?

Using cisco-sa-20190320-ip-phone-rce, an attacker can cause a denial of service condition or execute arbitrary code on the affected devices.

Vulnerability/
cisco-sa-20190320-ip-phone-rce

high

7.5

CWE

20/3/2019

cisco-sa-20190320-ip-phone-rce: Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability

First published: Wed Mar 20 2019(Updated: )

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability exists because the software improperly validates user-supplied input during user authentication. An attacker could exploit this vulnerability by connecting to an affected device using HTTP and supplying malicious user credentials. A successful exploit could allow the attacker to trigger a reload of an affected device, resulting in a DoS condition, or to execute arbitrary code with the privileges of the app user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-rce

Credit: David Gullasch modzero AGDenys Vozniuk DarkMatter for independently reporting this vulnerability

Affected Software	Affected Version	How to fix
Cisco IP Phone 7800 Series Firmware
Cisco IP Phone 8800 key expansion module

Never miss a vulnerability like this again

Reference Links

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-rce (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

CVE-2019-1716

Frequently Asked Questions

What is the severity of cisco-sa-20190320-ip-phone-rce?
The severity of cisco-sa-20190320-ip-phone-rce is high, as it can lead to denial of service or arbitrary code execution.
How do I fix cisco-sa-20190320-ip-phone-rce?
To fix cisco-sa-20190320-ip-phone-rce, you need to update the firmware of the affected Cisco IP Phone models to the latest version.
What products are affected by cisco-sa-20190320-ip-phone-rce?
The affected products by cisco-sa-20190320-ip-phone-rce are the Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series.
Can cisco-sa-20190320-ip-phone-rce be exploited remotely?
Yes, cisco-sa-20190320-ip-phone-rce can be exploited by an unauthenticated remote attacker.
What kind of attacks can be performed using cisco-sa-20190320-ip-phone-rce?
Using cisco-sa-20190320-ip-phone-rce, an attacker can cause a denial of service condition or execute arbitrary code on the affected devices.

agent/author
agent/type
agent/event
agent/last-modified-date
agent/first-publish-date
collector/cisco-advisory
source/Cisco
agent/references
agent/weakness
agent/severity
agent/title
agent/description
agent/source
agent/softwarecombine
agent/tags
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/cisco
canonical/cisco ip phone 7800 series firmware
canonical/cisco ip phone 8800 key expansion module