The image-upgrade functionality on Cisco 9900 Unified IP phones allows local users to gain privileges by placing shell commands in an unspecified parameter, aka Bug ID CSCuh10334.
http://www.securityfocus.com/bid/62943
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5533