CVE-2016-1476
MEDIUMCisco IP Phone 8800 Series Firmware 11.0 - Authenticated Cross-Site Scripting via Crafted Parameters
Title source: llmDescription
Cross-site scripting (XSS) vulnerability on Cisco IP Phone 8800 devices with software 11.0 allows remote authenticated users to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCuz03024.
References (3)
Core 3
Core References
Mitigation, Vendor Advisory vendor-advisory
x_refsource_cisco
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-ip-phone-8800
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/92404
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1036595
Scores
CVSS v3
5.4
EPSS
0.0080
EPSS Percentile
52.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
cisco/ip_phone_8800_series_firmware
11.0_base
Published
Aug 22, 2016
Tracked Since
Feb 18, 2026