CVE-2018-0461 — MEDIUM (6.5)

Vulnerability Description

A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insufficiently validates user-supplied data. An attacker could exploit this vulnerability by persuading a user to click a malicious link provided to the user or through the interface of an affected device. A successful exploit could allow an attacker to execute arbitrary script code in the context of the user interface or access sensitive system-based information, which under normal circumstances should be prohibited.

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Ip Phone 8800 Series Firmware	12.5\(1\)
Cisco	Ip Phone 8811	-
Cisco	Ip Phone 8841	-
Cisco	Ip Phone 8845	-
Cisco	Ip Phone 8851	-
Cisco	Ip Phone 8861	-
Cisco	Ip Phone 8865	-

Related Weaknesses (CWE)

CWE-94

References

http://www.securityfocus.com/bid/106515Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
http://www.securityfocus.com/bid/106515Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory

FAQ

What is CVE-2018-0461?

CVE-2018-0461 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exis...

How severe is CVE-2018-0461?

CVE-2018-0461 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-0461?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ip Phone 8800 Series Firmware, Cisco Ip Phone 8811, Cisco Ip Phone 8841, Cisco Ip Phone 8845, Cisco Ip Phone 8851.