CVE-2021-34711

CWE-36CWE-22 — Path Traversal4 documents4 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 79.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
17
Cisco IP Conference Phone 7832 FirmwareCisco IP Conference Phone 8832 FirmwareCisco IP Phone 7811 Firmware+14 more
Timeline
PublishedOct 6
Latest updateMay 24

Description

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug shell command. A successful exploit could allow the attacker to read any file on the device file system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages17 packages

🔴Vulnerability Details

2
GHSA
GHSA-rh9c-8fw7-2j3p: A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system↗2022-05-24
▶
CVEList
Cisco IP Phone Software Arbitrary File Read Vulnerability↗2021-10-06
▶

📋Vendor Advisories

1
Cisco
Cisco IP Phone Software Arbitrary File Read Vulnerability↗2021-10-06
▶
CVE-2021-34711 (MEDIUM CVSS 5.5) | A vulnerability in the debug shell | cvebase.io