Buffer overflow in Cisco Ip Phone 8800 Firmware
CVE-2021-33478
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (23.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 23.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Cisco Ip Phone 8800 Firmware
- Cisco Ip Phone 8800 Series With Multiplatform Firmware
- Cisco Ip Phone 8811 Firmware
- Cisco Ip Phone 8811 With Multiplatform Firmware
- Cisco Ip Phone 8841 Firmware
- Cisco Ip Phone 8841 With Multiplatform Firmware
- Cisco Ip Phone 8845 Firmware
- Cisco Ip Phone 8845 With Multiplatform Firmware
- Cisco Ip Phone 8851 Firmware
- Cisco Ip Phone 8851 With Multiplatform Firmware
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2021-33478?
- CVE-2021-33478 is a medium-severity vulnerability in Cisco Ip Phone 8800 Firmware, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.8/10. Published 2021-07-22.
- How severe is CVE-2021-33478?
- Medium severity. CVSS v3 base score is 6.8 out of 10.