CVE-2018-0341CWE-77

A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated…

published July 16, 2018

CVSS
—
EPSS
6%
Percentile
93.1
In the wild
Unconfirmed
What it is

A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remote attacker to perform a command injection and execute commands with the privileges of the web server. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including arbitrary shell commands in a specific user input field. Cisco Bug IDs: CSCvi51426.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05798 · 93.1th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2018-07-16T17:00Z
EPSS history
Timeline
  • 16 JUL 17:00Z
    A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated…
    cvelistv5