Ip Phone 8832 Firmware
Monthly
Reflected cross-site scripting in the web UI of Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software lets an unauthenticated, remote attacker execute arbitrary script in a victim's browser context by persuading them to click a crafted link. The vulnerability carries a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.29% (19th percentile), consistent with a targeted, interaction-dependent flaw. Real-world exposure is further constrained because the phone must be registered to Cisco Unified Communications Manager and have the Web Access feature enabled, which is disabled by default, so standard out-of-the-box deployments are not reachable. Overall this is a moderate, not high-priority, issue once the non-default configuration requirement and the mandatory user interaction are weighed against the raw score.
Crafted HTTP input sent to the web UI of affected Cisco SIP Software phones triggers a stack-based buffer overflow that reloads the device, producing a denial-of-service condition against voice endpoints. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and covers Cisco Desk Phone 9800 Series (9841/9851/9861/9871), Cisco IP Phone 7800 Series (7811/7821/7841/7861) and 8800 Series (8811/8821/8832/8841/8845/8851/8861/8865), and Cisco Video Phone 8875 running Cisco SIP Software; impact is limited to availability, with no code execution, data exposure, or integrity impact indicated. Exploitation is gated by two non-default prerequisites that Cisco states explicitly - the phone must be registered to Cisco Unified Communications Manager and the Web Access feature must be enabled (it is disabled by default) - so out-of-the-box deployments are not exposed, and no public exploit code or CISA KEV listing was identified at time of analysis, with EPSS low at 0.48% (40th percentile).
Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the kernel in NetBSD 7.1. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is. Rated low severity (CVSS 3.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in the web UI of Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running Cisco SIP Software lets an unauthenticated, remote attacker execute arbitrary script in a victim's browser context by persuading them to click a crafted link. The vulnerability carries a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.29% (19th percentile), consistent with a targeted, interaction-dependent flaw. Real-world exposure is further constrained because the phone must be registered to Cisco Unified Communications Manager and have the Web Access feature enabled, which is disabled by default, so standard out-of-the-box deployments are not reachable. Overall this is a moderate, not high-priority, issue once the non-default configuration requirement and the mandatory user interaction are weighed against the raw score.
Crafted HTTP input sent to the web UI of affected Cisco SIP Software phones triggers a stack-based buffer overflow that reloads the device, producing a denial-of-service condition against voice endpoints. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and covers Cisco Desk Phone 9800 Series (9841/9851/9861/9871), Cisco IP Phone 7800 Series (7811/7821/7841/7861) and 8800 Series (8811/8821/8832/8841/8845/8851/8861/8865), and Cisco Video Phone 8875 running Cisco SIP Software; impact is limited to availability, with no code execution, data exposure, or integrity impact indicated. Exploitation is gated by two non-default prerequisites that Cisco states explicitly - the phone must be registered to Cisco Unified Communications Manager and the Web Access feature must be enabled (it is disabled by default) - so out-of-the-box deployments are not exposed, and no public exploit code or CISA KEV listing was identified at time of analysis, with EPSS low at 0.48% (40th percentile).
Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the kernel in NetBSD 7.1. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is. Rated low severity (CVSS 3.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.