cisco telephone worker

Cisco IP Phones Web Server Multiple Vulnerabilities 

Basic 

← View More Research Advisories 

Abstract 

While leading exploration on a Cisco Wireless IP Phone 8821, Tenable found several weaknesses influencing various Cisco IP Phone models. 

CVE-2020-3161: Unauthenticated Stack-Based Buffer Overflow 

An unauthenticated distant aggressor can trigger a stack-based cisco phone server cradle flood by sending a created HTTP solicitation to the/deviceconfig/setActivationCode endpoint. In libHTTPService.so, the boundaries after/deviceconfig/setActivationCode are utilized to make another URI through a sprintf work call. The length of the boundary string isn't checked. At the point when an assailant gives a long boundary string then sprintf floods the gave stack-based cushion. This outcomes in an accident of the gadget or might take into account far off code execution. 

A forswearing of administration verification of idea can be found on our GitHub. 

CVE-2016-1421: Unauthenticated Stack-Based Buffer Overflow 

An unauthenticated far off aggressor can trigger a stack-based cushion flood by sending a made HTTP solicitation to the/CGI/CallInfo endpoint. In libHTTPService.so, the boundaries after/CGI/CallInfo are attached to a stack support utilizing strcat. The length of the boundary string isn't checked. At the point when an assailant gives a long boundary string, strcat floods the cradle. This outcomes in an accident of the gadget or might consider far off code execution. 

A disavowal of administration verification of idea can be found on our GitHub. 

During Tenable's unique examination, they noticed the closeness of this weakness to CSCuz03016. Nonetheless, Cisco's warning portrayed the weakness as requiring verification, DoS just, and the Wireless IP Phone 8821 wasn't recorded on the influenced list. In the wake of unveiling to Cisco, they educated Tenable that the depicted bug was CVE-2016-1421 and along these lines refreshed their exposure. 

Arrangement 

Move up to the accompanying variants or later: 

IP Phone 78xx: 11.7(1) 

IP Phone 88xx: 11.7(1) 

Bound together IP Conference Phone 8831: 10.3(1)SR6 

Remote IP Phone 8821, 8821-EX: 11.0(5)SR3