Cisco Unified IP Phone Firmware vulnerabilities

4 CVEs affecting Cisco Unified IP Phone Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-0332, published 2018-06-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-0332, published 2018-06-07. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software could allow an unauthenticated, remote attacker to cause a denial of service…
CVE-2013-3468, published 2013-08-29. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. The Cisco Unified IP Phone 8945 with software 9.3(2) allows remote attackers to cause a denial of service (device hang) via a malformed PNG file, aka Bug ID CSCud04270.
CVE-2012-1328, published 2012-05-03. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Cisco Unified IP Phones 9900 series devices with firmware 9.1 and 9.2 do not properly handle downloads of configuration information to an RT phone, which allows local users to gain privileges via…
CVE-2013-6685, published 2013-11-13. Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days. The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gain privileges by mounting a device with a setuid file in its…