Improper input validation in Cisco Skinny Client Control Protocol Software
CVE-2012-5445
The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.004 (32.7th percentile) — read the EPSS interpretation.
Affected products
- Cisco Skinny_client_control_protocol_software — versions 1.0\(1\), 1.0\(2\), 1.0\(3\)
- Cisco Unified_ip_phone — versions 7906g, 7911g, 7935
- Cisco Unified_ip_phone_7906g — versions 7911g, 7941g, 7961g
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory)
- psirt@cisco.com (x_refsource_MISC)