VAR-201606-0326
Vulnerability from variot - Updated: 2023-12-18 12:44CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz03005. The Cisco IP8800phone is a telephone product that provides video and VoIP communication capabilities at Cisco. A permission acquisition vulnerability exists in the Cisco IP8800phone using version 11.0.1 and earlier software. A local attacker could exploit the vulnerability to gain permission to execute operating system commands with the help of specially crafted CLI commands. This may aid in further attacks. This issue being tracked by Cisco Bug ID CSCuz03005. Cisco IP 8800 Series Phones running versions 11.0.1 and prior are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201606-0326",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ip phone 8800 series",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "10.2\\(1\\)"
},
{
"model": "ip phone 8800 series",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "10.3\\(2\\)"
},
{
"model": "ip phone 8800 series",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "10.3"
},
{
"model": "ip phone 8800 series",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "10.2\\(2\\)"
},
{
"model": "ip phone 8800 series",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "11.0\\(1\\)"
},
{
"model": "ip phone 8800 series",
"scope": "lte",
"trust": 0.8,
"vendor": "cisco",
"version": "11.0.1"
},
{
"model": "ip phones",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "8800\u003c=11.0.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8800_series_firmware:10.3\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8800_series_firmware:11.0\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8800_series_firmware:10.2\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8800_series_firmware:10.2\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:ip_phone_8800_series_firmware:10.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1403"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco",
"sources": [
{
"db": "BID",
"id": "91037"
}
],
"trust": 0.3
},
"cve": "CVE-2016-1403",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.2,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2016-1403",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2016-03859",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "VHN-90222",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2016-1403",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-1403",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2016-03859",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201606-133",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-90222",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "VULHUB",
"id": "VHN-90222"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz03005. The Cisco IP8800phone is a telephone product that provides video and VoIP communication capabilities at Cisco. A permission acquisition vulnerability exists in the Cisco IP8800phone using version 11.0.1 and earlier software. A local attacker could exploit the vulnerability to gain permission to execute operating system commands with the help of specially crafted CLI commands. This may aid in further attacks. \nThis issue being tracked by Cisco Bug ID CSCuz03005. \nCisco IP 8800 Series Phones running versions 11.0.1 and prior are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "BID",
"id": "91037"
},
{
"db": "VULHUB",
"id": "VHN-90222"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-1403",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-03859",
"trust": 0.6
},
{
"db": "BID",
"id": "91037",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-90222",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "VULHUB",
"id": "VHN-90222"
},
{
"db": "BID",
"id": "91037"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"id": "VAR-201606-0326",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "VULHUB",
"id": "VHN-90222"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
}
]
},
"last_update_date": "2023-12-18T12:44:51.466000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20160603-ipp",
"trust": 0.8,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160603-ipp"
},
{
"title": "Cisco IP8800phone permissions to obtain patches for vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/77108"
},
{
"title": "Cisco IP 8800 phone Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=62101"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-90222"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "NVD",
"id": "CVE-2016-1403"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160603-ipp"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1403"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1403"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "VULHUB",
"id": "VHN-90222"
},
{
"db": "BID",
"id": "91037"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"db": "VULHUB",
"id": "VHN-90222"
},
{
"db": "BID",
"id": "91037"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-06-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"date": "2016-06-04T00:00:00",
"db": "VULHUB",
"id": "VHN-90222"
},
{
"date": "2016-06-03T00:00:00",
"db": "BID",
"id": "91037"
},
{
"date": "2016-06-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"date": "2016-06-04T14:59:01.407000",
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"date": "2016-06-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-06-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-03859"
},
{
"date": "2016-06-07T00:00:00",
"db": "VULHUB",
"id": "VHN-90222"
},
{
"date": "2016-07-06T14:57:00",
"db": "BID",
"id": "91037"
},
{
"date": "2016-06-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003023"
},
{
"date": "2016-06-07T14:21:22.470000",
"db": "NVD",
"id": "CVE-2016-1403"
},
{
"date": "2016-06-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "91037"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco IP Phone 8800 In software OS Vulnerability that can get command execution privileges",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003023"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-133"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…