Detections
Analytics
Cisco Unified IP Phones Multiple Vulnerabilities (cisco-sa-20110601-phone)
medium Nessus Plugin ID 70095
Language:
Synopsis
The remote IP telephony device is missing a vendor-supplied patch.Description
According to its self-reported version, the version of the Cisco Unified IP Phone software running on the remote device has the following vulnerabilities :- Cisco Unified IP Phones 7900 series are prone to privilege escalation vulnerabilities. An authenticated attacker could exploit this issue to perform unauthorized phone configuration changes or to gain access to sensitive information. (CVE-2011-1602, CVE-2011-1603)
- Cisco Unified IP Phones 7900 series are prone to a security bypass vulnerability. An attacker can exploit this issue to bypass the signature-verification mechanism. Successful exploits could allow an authenticated attacker to load a crafted software image with no signature verification. (CVE-2011-1637)
Solution
Apply the relevant update referenced in Cisco Security Advisory cisco-sa-20110601-phone.See Also
Plugin Details
Severity: Medium
ID: 70095
File Name: cisco-sa-20110601-phone.nasl
Version: 1.7
Type: local
Family: CISCO
Published: 9/24/2013
Updated: 11/15/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.6
Temporal Score: 4.9
Vector: CVSS2#AV:L/AC:M/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/h:cisco:ip_phone
Required KB Items: Settings/ParanoidReport, Host/Cisco/CNU-OS
Exploit Ease: No known exploits are available
Patch Publication Date: 6/1/2011
Vulnerability Publication Date: 6/1/2011