Cisco 7920 Wireless IP Phone VxWorks Remote Debugger Access Vulnerability

Bugtraq ID:	15456
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 16 2005 12:00AM
Updated:	Nov 16 2005 12:00AM
Credit:	Discovered by Shawn Merdinger.
Vulnerable:	Cisco 7920 Wireless IP Phone 2.0 Cisco 7920 Wireless IP Phone 1.0 (8)
Not Vulnerable:	Cisco 7920 Wireless IP Phone 2.0 1

Cisco 7920 Wireless IP Phone VxWorks Remote Debugger Access Vulnerability

Cisco 7920 Wireless IP Phone allows remote debugger connections. Successful exploitation of this vulnerability could allow a remote attacker to obtain debugging information from the device or cause a denial of service.

Cisco 7920 Wireless IP Phones running firmware version 2.0 and earlier are vulnerable to this issue.

Cisco 7920 Wireless IP Phone VxWorks Remote Debugger Access Vulnerability

An exploit is not required.

Cisco 7920 Wireless IP Phone VxWorks Remote Debugger Access Vulnerability

Solution:
Cisco has released an updated firmware version to address this issue. Please see the referenced advisory for fix information.

Cisco 7920 Wireless IP Phone VxWorks Remote Debugger Access Vulnerability

References:

• Cisco Security Advisory: Fixed SNMP Communities and Open UDP Port in Cisco 7920 (Cisco)
  
• Cisco Wireless IP Phone 7920 (Cisco)