Zach Sanchez

**Name of the Vulnerable Software and Affected Versions** Cisco Desk Phone 9800 Series Cisco IP Phone 7800 and 8800 Series Cisco Video Phone 8875 **Description** A vulnerability in the directory permissions of the affected devices could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability exists because the product exposes sensitive information to an unauthorized actor. An attacker could exploit this by sending a crafted packet to the IP address of a device with Web Access enabled. A successful exploit could allow the attacker to access sensitive information from the device. **Recommendations** Ensure Web Access is disabled on the devices, as it is disabled by default.

**Name of the Vulnerable Software and Affected Versions** Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series (affected versions not specified) **Description** A vulnerability in the debug shell of the affected devices could allow an authenticated, local attacker to access sensitive information on the device. The attacker must have valid administrative credentials with SSH access on the device. SSH access is disabled by default. This issue is due to insufficient validation of user-supplied input by the debug shell. An attacker could exploit this by sending a crafted SSH client command to the CLI, potentially allowing access to sensitive information on the underlying operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.