CVE-2021-1379: cisco cisco ip phones with multiplatform firmware Classic Buffer Overflow

Vulnerability summary

CVE-2021-1379 is a medium (CVSS 6.5) Classic Buffer Overflow vulnerability in cisco cisco ip phones with multiplatform firmware. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.5% of scored vulnerabilities.

Timeline

1. 18-11-2024
   PublishedVulnerability first disclosed.
2. 18-11-2024
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are due to missing checks when the IP phone processes a Cisco Discovery Protocol or LLDP packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol or LLDP packet to the targeted IP phone. A successful exploit could allow the attacker to execute code on the affected IP phone or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition.Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.