Cisco IP Phone 8800 Web-based Management Interface URL access control

Summaryinfo

A vulnerability labeled as critical has been found in Cisco IP Phone 8800. Affected by this issue is some unknown functionality of the component Web-based Management Interface. Executing a manipulation as part of URL can lead to access control. This vulnerability is registered as CVE-2019-1763. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Cisco IP Phone 8800 (IP Phone Software) (the affected version unknown). It has been declared as critical. This vulnerability affects an unknown part of the component Web-based Management Interface. The manipulation as part of a URL leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exists because the software fails to sanitize URLs before it handles requests. An attacker could exploit this vulnerability by submitting a crafted URL. A successful exploit could allow the attacker to gain unauthorized access to critical services and cause a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.

The bug was discovered 03/20/2019. The weakness was published 03/22/2019 as cisco-sa-20190320-ipab as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2019-1763 since 12/06/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

Similar entries are available at VDB-132103, VDB-132102 and VDB-132101. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• IP Phone Software

Vendor

• Cisco

Name

• IP Phone 8800

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion