Buffer overflow in Cisco Systems, Inc products - CVE-2021-1379

Vulnerability identifier: #VU51233

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1379

CWE-ID: CWE-119

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations. A remote attacker on the local network can trigger memory corruption and execute arbitrary code on the target IP phone or cause a denial of service (DoS) condition.

Cisco Unified IP Conference Phone 8831 for Third-Party Call Control
Cisco SPA525G 5-Line IP Phone
Cisco Unified IP Conference Phone 8831
Cisco Wireless IP Phone 8821-EX
Cisco Wireless IP Phone 8821
Cisco IP Phone 7861 with Multiplatform Firmware
Cisco IP Phone 8865 with Multiplatform Firmware
Cisco IP Phone 8845 with Multiplatform Firmware
Cisco IP Phone 8861 with Multiplatform Firmware
Cisco IP Phone 8851 with Multiplatform Firmware
Cisco IP Phone 8841 with Multiplatform Firmware
Cisco IP Phone 8811 with Multiplatform Firmware
Cisco IP Phone 7841 with Multiplatform Firmware
Cisco IP Phone 7821 with Multiplatform Firmware
Cisco IP Phone 6861 with Multiplatform Firmware
Cisco IP Conference Phone 7832 with Multiplatform Firmware
Cisco IP Conference Phone 8832 with Multiplatform Firmware
Cisco IP Phone 6821 with Multiplatform Firmware
Cisco IP Phone 6841 with Multiplatform Firmware
Cisco IP Phone 6851 with Multiplatform Firmware
Cisco IP Phone 6871 with Multiplatform Firmware
Cisco IP Phone 7811 with Multiplatform Firmware
Cisco IP Phone 8841
Cisco IP Phone 7811
Cisco Wireless IP Phone 8851
Cisco IP Phone 7821
Cisco IP Phone 8811
Cisco Wireless IP Phone 8845
Cisco IP Conference Phone 7832
Cisco IP Phone 7861
Cisco IP Conference Phone 8832
Cisco IP Phone 7841
Cisco IP Phone 8861
Cisco IP Phone 8865

Install updates from vendor's website.

Cisco Unified IP Conference Phone 8831 - update to 10.3.1 SR7
Cisco Wireless IP Phone 8821-EX - update to 11.0.6.6
Cisco Wireless IP Phone 8821 - update to 11.0.6.6
Cisco IP Phone 7861 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8865 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8845 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8861 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8851 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8841 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8811 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 7841 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 7821 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 6861 with Multiplatform Firmware - update to 11.3.2
Cisco IP Conference Phone 7832 with Multiplatform Firmware - update to 11.3.2
Cisco IP Conference Phone 8832 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 6821 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 6841 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 6851 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 6871 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 7811 with Multiplatform Firmware - update to 11.3.2
Cisco IP Phone 8841 - update to 12.8.1 SR1
Cisco IP Phone 7811 - update to 12.8.1 SR1
Cisco Wireless IP Phone 8851 - update to 12.8.1 SR1
Cisco IP Phone 7821 - update to 12.8.1 SR1
Cisco IP Phone 8861 - update to 12.8.1 SR1
Cisco IP Phone 8811 - update to 12.8.1 SR1
Cisco Wireless IP Phone 8845 - update to 12.8.1 SR1
Cisco IP Conference Phone 7832 - update to 12.8.1 SR1
Cisco IP Phone 7861 - update to 12.8.1 SR1
Cisco IP Conference Phone 8832 - update to 12.8.1 SR1
Cisco IP Phone 8865 - update to 12.8.1 SR1
Cisco IP Phone 7841 - update to 12.8.1 SR1

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-rce-dos-U2PsSkz3

• Remote code execution in Cisco IP Phones