N/A

A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remote attacker to perform a command injection and execute commands with the privileges of the web server. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including arbitrary shell commands in a specific user input field. Cisco Bug IDs: CSCvi51426.

N/A

在命令中使用的特殊元素转义处理不恰当(命令注入)

Cisco IP Phone 6800、7800和8800系列命令注入漏洞

Cisco IP Phone 6800、7800和8800 Series都是美国思科（Cisco）公司的不同系列的IP电话产品。Multiplatform Firmware是运行在其中的一套支持多平台的防火墙软件。 使用Multiplatform Firmware 11.2(1)之前版本的Cisco IP Phone 6800、7800和8800系列中基于Web的UI存在命令注入漏洞，该漏洞源于程序没有充分的验证输入。远程攻击者可借助用户输入字段中任意的shell命令利用该漏洞注入并以Web服务器权限执行

N/A

N/A