CVE-2017-12305CWE-77

A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug…

published November 16, 2017

CVSS
—
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug Shell Command Injection. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting additional command input to the affected parameter in the debug shell. Cisco Bug IDs: CSCvf80034.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00839 · 57.4th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2017-11-16T07:00Z
EPSS history
Timeline
  • 16 NOV 07:00Z
    A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug…
    cvelistv5