CVE-2018-0461 : A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauth

A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insufficiently validates user-supplied data. An attacker could exploit this vulnerability by persuading a user to click a malicious link provided to the user or through the interface of an affected device. A successful exploit could allow an attacker to execute arbitrary script code in the context of the user interface or access sensitive system-based information, which under normal circumstances should be prohibited.

Published 2019-01-10 16:29:00

Updated 2019-10-09 23:32:08

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2018-0461

Cisco » Ip Phone 8800 Series Firmware » Version: 12.5(1)
cpe:2.3:o:cisco:ip_phone_8800_series_firmware:12.5\(1\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ip Phone 8811 » Version: N/A
When used together with: Cisco » Ip Phone 8841 » Version: N/A
When used together with: Cisco » Ip Phone 8845 » Version: N/A
When used together with: Cisco » Ip Phone 8851 » Version: N/A
When used together with: Cisco » Ip Phone 8861 » Version: N/A
When used together with: Cisco » Ip Phone 8865 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-0461

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 57 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-0461

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2018-0461

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2018-0461

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-phone-script-injection

Cisco IP Phone 8800 Series Arbitrary Script Injection Vulnerability
Vendor Advisory
http://www.securityfocus.com/bid/106515

Cisco IP Phone 8800 Series CVE-2018-0461 Arbitrary Script Injection Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2018-0461

Products affected by CVE-2018-0461

Exploit prediction scoring system (EPSS) score for CVE-2018-0461

CVSS scores for CVE-2018-0461

CWE ids for CVE-2018-0461

References for CVE-2018-0461