Cisco IP Phone 7800 Series and 8800 Series CVE-2019-1716 Remote Code Execution Vulnerability

Bugtraq ID:	107503
Class:	Input Validation Error
CVE:	CVE-2019-1716
Remote:	Yes
Local:	No
Published:	Mar 20 2019 12:00AM
Updated:	Mar 20 2019 12:00AM
Credit:	David Gullasch of modzero AG and Denys Vozniuk of DarkMatter.
Vulnerable:	Cisco Wireless IP Phone 8821-EX 11.0(4)SR2 Cisco Wireless IP Phone 8821-EX 11.0(4)SR1 Cisco Wireless IP Phone 8821 11.0(4)SR2 Cisco Wireless IP Phone 8821 11.0(4)SR1 Cisco Unified IP Conference Phone 8831 10.3(1)SR4b Cisco Unified IP Conference Phone 8831 10.3(1)SR3 Cisco Unified IP Conference Phone 8831 10.3(1)SR2 Cisco Unified IP Conference Phone 8831 10.3(1)SR1 Cisco Unified IP Conference Phone 8831 10.3(1) Cisco IP Phone 8800 Series 9.4(2) Cisco IP Phone 8800 Series 12.5(1) Cisco IP Phone 8800 Series 11.0(4)SR2015 Cisco IP Phone 7800 Series 12.5(1)
Not Vulnerable:	Cisco Wireless IP Phone 8821-EX 11.0(4)SR3 Cisco Wireless IP Phone 8821 11.0(4)SR3 Cisco Unified IP Conference Phone 8831 10.3(1)SR5 Cisco IP Phone 8800 Series 12.6(1)MN112 Cisco IP Phone 8800 Series 12.5(1)SR2 Cisco IP Phone 8800 Series 12.5(1)SR1.3 Cisco IP Phone 8800 Series 12.5(1)SR1 Cisco IP Phone 8800 Series 12.5(1)ES2 Cisco IP Phone 8800 Series 11.0(5.5) Cisco IP Phone 8800 Series 11.0(4)SR3.2 Cisco IP Phone 8800 Series 11.0(4)SR3 Cisco IP Phone 8800 Series 11.0(4)MN43 Cisco IP Phone 7800 Series 12.5(1)SR1

Cisco IP Phone 7800 Series and 8800 Series CVE-2019-1716 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco IP Phone 7800 Series and 8800 Series CVE-2019-1716 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco IP Phone 7800 Series and 8800 Series CVE-2019-1716 Remote Code Execution Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability (Cisco)