Cisco IP Phones 7800 Series and 8800 Series and Cisco Wireless IP Phone 8821 Denial of Service (CVE-2018-0325)

A vulnerability in the Session Initiation Protocol SIP call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected phone. The vulnerability is due t...

Cisco IP Phones 8800 Series Arbitrary Script Injection (CVE-2018-0461)

A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insufficiently validates user-supplied data...

Cisco Unified IP Phones 9900 Code Injection (CVE-2012-1328)

Cisco Unified IP Phones 9900 series devices with firmware 9.1 and 9.2 do not properly handle downloads of configuration information to an RT phone, which allows local users to gain privileges via unspecified injected data, aka Bug ID CSCts32237. This plugin only works with Tenable.ot. Please visi...

Cisco IP Phones Duplicate Key (CVE-2022-20817)

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager CUCM is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could resul...

Cisco IP Phones 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting (CVE-2019-16008)

A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface of an affected system. The vulnerability is due to...

Cisco IP Phones Web-based Management Interface Stack-based Buffer Overflow (CVE-2023-20078)

Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Details section of this advisor...

Cisco IP Phones Web Server Remote Code Execution and Denial of Service (CVE-2020-3161)

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service DoS condition. The vulnerability is due to a lack of proper input validation of HT...

Cisco IP Phones 8800 Series Command Injection Vulnerability in Debug Shell (CVE-2017-12305)

A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug Shell Command Injection. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

Cisco IP Phones TCP Packet Flood Denial of Service (CVE-2020-3574)

A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop responding to incoming calls, drop connected calls, or unexpectedly reload. The vulnerability is due to insufficient TCP ingress packet rate...

Cisco IP Phones 7800 Series and 8800 Series Remote Code Execution (CVE-2019-1716)

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or execute arbitrary code. The vulnerability...

Cisco IP Phones 8800 Series Cross-Site Scripting (CVE-2016-1476)

Cross-site scripting XSS vulnerability on Cisco IP Phone 8800 devices with software 11.0 allows remote authenticated users to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCuz03024. This plugin only works with Tenable.ot. Please visit...

Cisco IP Phones 8800 Series Denial of Service (CVE-2017-12328)

A vulnerability in Session Initiation Protocol SIP call handling in Cisco IP Phone 8800 Series devices could allow an unauthenticated, remote attacker to cause a denial of service DoS condition because the SIP process unexpectedly restarts. All active phone calls are dropped as the SIP process...

Cisco IP Phones 8800 Series Denial of Service (CVE-2016-1479)

Cisco IP Phone 8800 devices with software 11.01 allow remote attackers to cause a denial of service memory corruption via a crafted HTTP request, aka Bug ID CSCuz03038. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Cisco IP Phones 8800 Series Authorization Bypass (CVE-2019-1763)

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service DoS condition. The vulnerability exists...

Cisco Unified IP Phone 8900/9900 Series Crafted SDP Packet (CVE-2013-5526)

Cisco 9900 fourth-generation IP phones do not properly perform SDP negotiation, which allows remote attackers to cause a denial of service device reboot via crafted SDP packets, aka Bug ID CSCuf06698. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...

Cisco Unified IP Phone 9900 Series Denial of Service (CVE-2015-0601)

Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allow local users to cause a denial of service device reload via crafted commands, aka Bug ID CSCup92790. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEV...

Cisco IP Phones 6800, 7800, and 8800 Series with Multiplatform Firmware Session Initiation Protocol Denial of Service (CVE-2018-0316)

A vulnerability in the Session Initiation Protocol SIP call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware could allow an unauthenticated, remote attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of...

Cisco IP Phones Web Application Buffer Overflow (CVE-2016-1421)

A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service DoS condition. The vulnerability exists because the affected software fails t...

Cisco IP Phones 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Request Forgery (CVE-2022-20774)

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against a user of the web-based interface of an affected system. This...

Cisco Multiple Products Use of a Broken or Risky Cryptographic Algorithm (CVE-2020-26142)

The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and...