CVE-2013-5532

Buffer overflow in the web-application interface on Cisco 9900 IP phones allows remote attackers to cause a denial of service webapp interface outage via long values in unspecified fields, aka Bug ID CSCuh10343...

Cisco IP Phones Improper Input Validation (CVE-2008-4444)

Cisco Unified IP Phone aka SIP phone 7960G and 7940G with firmware P0S3-08-9-00 and possibly other versions before 8.10 allows remote attackers to cause a denial of service device reboot or possibly execute arbitrary code via a Realtime Transport Protocol RTP packet with malformed headers. This...

Cisco IP Phones Improper Neutralization of Input During Web Page Generation (CVE-2011-2545)

Cross-site scripting XSS vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102 before 5.2.13, and SPA 500 series IP phones before 7.4.9 allows remote attackers to inject arbitrary web script or HTML via the FROM field of an INVITE message, aka...

Cisco IP Phones Denial of Service (CVE-2003-1109)

The Session Initiation Protocol SIP implementation in multiple Cisco products including IP Phone models 7940 and 7960, IOS versions in the 12.2 train, and Secure PIX 5.2.9 to 6.2.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages...

CVE-2024-20450

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system with root privileges...

CVE-2024-20451

Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly. These vulnerabilities exist because...

Cisco Small Business IP Improper Authentication (CVE-2012-0333)

Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768. This plugin only works with Tenable.ot. Please visit...

Cisco IP Phones 7902/7905/7912, ATA 186/188, Unity Express, ACNS, and Subscriber Edge Services Manager Denial of Service (CVE-2005-4794)

Cisco IP Phones 7902/7905/7912, ATA 186/188, Unity Express, ACNS, and Subscriber Edge Services Manager SESM allows remote attackers to cause a denial of service crash or instability via a compressed DNS packet with a label length byte with an incorrect offset. This plugin only works with...

Cisco IP Phones 7910, 7940, and 7960 Incorrect Default Permissions (CVE-2002-0881)

Cisco IP Phone VoIP models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Cisco IP Phones 7910, 7940, and 7960 Denial of Service (CVE-2002-0880)

Cisco IP Phone VoIP models 7910, 7940, and 7960 allow remote attackers to cause a denial of service crash via malformed packets as demonstrated by 1 jolt, 2 jolt2, 3 raped, 4 hping2, 5 bloop, 6 bubonic, 7 mutant, 8 trash, and 9 trash2. This plugin only works with Tenable.ot. Please visit...

Cisco Small Business SPA300 and SPA500 Series IP Phones Cross-site Scripting (CVE-2014-3313)

Cross-site scripting XSS vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582. This plugin only works with Tenable.ot. Please visit...

Cisco IP Phones 7910, 7940, and 7960 Denial of Service (CVE-2002-0882)

The web server for Cisco IP Phone VoIP models 7910, 7940, and 7960 allows remote attackers to cause a denial of service reset and possibly read sensitive memory via a large integer value in 1 the stream ID of the StreamingStatistics script, or 2 the port ID of the PortInformation script. This...

Cisco Small Business Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2017-12259)

A vulnerability in the implementation of Session Initiation Protocol SIP functionality in Cisco Small Business SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service DoS condition. The...

Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial (CVE-2015-0670)

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482. This plugin only works with...

CVE-2021-1379

Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol LLDP implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are...

CVE-2021-1379 Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol LLDP implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are...

Cisco IP Phones Information Disclosure (cisco-sa-phone-infodisc-sbyqQVbG)

According to its self-reported version, Cisco 7800, 8800, and 9800 Series Phones Information Disclosure is affected by a vulnerability. - A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated,...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 9800, 7800, 8800, and 8875 allows a perpetrator to access confidential information.

The vulnerability of the web interface of Microprogramming Software for Cisco IP Phones 9800, 7800, 8800, and 8875 lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information from a remote location...

Telisca IPS Lock Cisco IP Phone Control

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Telisca IPS Lock Cisco IP Phone Control', 'Description' = %q This module allows an unauthenticated attacker to exercise the "Lock" and "Unlock"...

CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature

The U.S. Cybersecurity and Infrastructure Security Agency CISA has disclosed that threat actors are abusing the legacy Cisco Smart Install SMI feature with the aim of accessing sensitive data. The agency said it has seen adversaries "acquire system configuration files by leveraging available...