What is the CVSS score of CVE-2021-34711?

CVE-2021-34711 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Ip Conference Phone 7832 Firmware CVE-2021-34711

MEDIUM

Absolute Path Traversal (CWE-36)

2021-10-06 psirt@cisco.com

Cisco Information Disclosure Ip Conference Phone 7832 Firmware Ip Conference Phone 8832 Firmware Ip Phone 7811 Firmware Ip Phone 7821 Firmware Ip Phone 7832 Firmware Ip Phone 7841 Firmware Ip Phone 7861 Firmware Ip Phone 8811 Firmware Ip Phone 8831 Firmware Ip Phones 8832 Firmware Ip Phone 8841 Firmware Ip Phone 8845 Firmware Ip Phone 8851 Firmware Ip Phone 8861 Firmware Ip Phone 8865 Firmware Wireless Ip Phone 8821 Firmware

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 06, 2021 - 20:15 nvd

MEDIUM 5.5

DescriptionNVD

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug shell command. A successful exploit could allow the attacker to read any file on the device file system.

AnalysisAI

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-36. A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug shell command. A successful exploit could allow the attacker to read any file on the device file system. Affected products include: Cisco Ip Conference Phone 7832 Firmware, Cisco Ip Conference Phone 8832 Firmware, Cisco Ip Phone 7811 Firmware, Cisco Ip Phone 7821 Firmware, Cisco Ip Phone 7832 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.