Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-1763

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exists because the software fails to sanitize URLs before it handles requests. An attacker could exploit this vulnerability by submitting a crafted URL. A successful exploit could allow the attacker to gain unauthorized access to critical services and cause a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.

Published

2019-03-22T20:29:00.400

Last Modified

2024-11-21T04:37:19.370

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-284
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System cisco ip_phone_8821_firmware < 11.0\(5\) Yes
Hardware cisco ip_phone_8821 - No
Operating System cisco ip_phone_8821-ex_firmware < 11.0\(5\) Yes
Hardware cisco ip_phone_8821-ex - No
Operating System cisco ip_conference_phone_8832_firmware < 12.5\(1\)sr1 Yes
Hardware cisco ip_conference_phone_8832 - No
Operating System cisco ip_phone_8800_firmware < 12.5\(1\)sr1 Yes
Hardware cisco ip_phone_8800 - No
References