Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2018-0461— Cisco IP Phone 8800 Series Arbitrary Script Injection Vulnerability

Quick assessment

Affected
Cisco Cisco IP Phone 8800 Series Software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cisco IP Phone 8800 Series是美国思科（Cisco）公司的一款提供视频和VoIP通信功能的电话产品。Cisco IP Phone 8800 Series Software是运行在其中的一套软件。 Cisco IP Phone 8800 Series Software中存在代码注入漏洞，该漏洞源于程序没有充分验证用户提交的数据。远程攻击者可借助特制的链接利用该漏洞在用户界面的上下文中执行任意脚本代码或访问基于系统的敏感信息。

AI Predicted 8.8 Difficulty: Moderate EPSS 1.50% · P73

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1189.002
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2018-0461

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cisco IP Phone 8800 Series Arbitrary Script Injection Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on an affected device. The vulnerability exists because the software running on an affected device insufficiently validates user-supplied data. An attacker could exploit this vulnerability by persuading a user to click a malicious link provided to the user or through the interface of an affected device. A successful exploit could allow an attacker to execute arbitrary script code in the context of the user interface or access sensitive system-based information, which under normal circumstances should be prohibited.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco IP Phone 8800 Series Software 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco IP Phone 8800 Series是美国思科（Cisco）公司的一款提供视频和VoIP通信功能的电话产品。Cisco IP Phone 8800 Series Software是运行在其中的一套软件。 Cisco IP Phone 8800 Series Software中存在代码注入漏洞，该漏洞源于程序没有充分验证用户提交的数据。远程攻击者可借助特制的链接利用该漏洞在用户界面的上下文中执行任意脚本代码或访问基于系统的敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cisco Cisco IP Phone 8800 Series Software n/a -

II. Public POCs for CVE-2018-0461

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2018-0461

请登录查看更多情报信息。

Vendor Advisories for CVE-2018-0461 (2)

Same Patch Batch · Cisco · 2019-01-10 · 14 CVEs total

CVE-2018-15461 Cisco Webex Business Suite Cross-Site Scripting Vulnerability
CVE-2018-15460 Cisco Email Security Appliance URL Filtering Denial of Service Vulnerability
CVE-2018-15457 Cisco Prime Infrastructure Cross-Site Scripting Vulnerability
CVE-2018-15458 Cisco Firepower Management Center Disk Utilization Denial of Service Vulnerability
CVE-2018-0484 Cisco IOS and IOS XE Software Secure Shell Connection on VRF Vulnerability
CVE-2018-15453 Cisco Email Security Appliance Memory Corruption Denial of Service Vulnerability
CVE-2018-15456 Cisco Identity Services Engine Password Recovery Vulnerability
CVE-2018-0482 Cisco Prime Network Control System Stored Cross-Site Scripting Vulnerability
CVE-2018-0483 Cisco Jabber Client Framework Instant Message Cross-Site Scripting Vulnerability
CVE-2018-0449 Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability
CVE-2018-0474 Cisco Unified Communications Manager Digest Credentials Disclosure Vulnerability
CVE-2018-0181 Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis
CVE-2018-0282 Cisco IOS and IOS XE Software TCP Denial of Service Vulnerability

IV. Related Vulnerabilities

Same product: Cisco IP Phone 8800 Series Software
Same vendor: Cisco
Same weakness: CWE-94

V. Comments for CVE-2018-0461

No comments yet

Leave a comment