A vulnerability in the web application of the Cisco IP Phone 8800 Series could allow an authenticated, remote malicious user to perform a stored, cross-site scripting (XSS) attack. The vulnerability is due to insufficient sanitization of parameter values. An attacker could exploit this vulnerability by storing malicious code on a device and waiting for a user to access a web page that triggers execution of the code. An exploit could allow the malicious user to execute arbitrary script code in the context of the web interface on the affected device. Cisco has not released software updates that address this vulnerability. Workarounds that address this vulnerability are not available. This advisory is available at the following link: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-ip-phone-8800
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cisco ip_phone_8800_series_firmware 11.0_base |
Vulmon