CVE-2013-6685

2013-11-1315:55:04

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:S/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

0.002

Percentile

64.8%

JSON

The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gain privileges by mounting a device with a setuid file in its filesystem, aka Bug ID CSCui04382.

Affected configurations

Nvd

Node

ciscounified_ip_phone_firmwareMatch-

AND

ciscounified_ip_phone_8961

ciscounified_ip_phone_9951

ciscounified_ip_phone_9971

VendorProductVersionCPE
ciscounified_ip_phone_firmware-cpe:2.3:o:cisco:unified_ip_phone_firmware:-:*:*:*:*:*:*:*
ciscounified_ip_phone_8961*cpe:2.3:h:cisco:unified_ip_phone_8961:*:*:*:*:*:*:*:*
ciscounified_ip_phone_9951*cpe:2.3:h:cisco:unified_ip_phone_9951:*:*:*:*:*:*:*:*
ciscounified_ip_phone_9971*cpe:2.3:h:cisco:unified_ip_phone_9971:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_ip_phone_firmware	-	cpe:2.3:o:cisco:unified_ip_phone_firmware:-:::::::*
cisco	unified_ip_phone_8961	*	cpe:2.3:h:cisco:unified_ip_phone_8961::::::::
cisco	unified_ip_phone_9951	*	cpe:2.3:h:cisco:unified_ip_phone_9951::::::::
cisco	unified_ip_phone_9971	*	cpe:2.3:h:cisco:unified_ip_phone_9971::::::::