Read the docs
TI-2019-01390 Aliases CVE-2019-1765GHSA-2473-cf85-p25m

Cisco IP Phone 8800 Series Path Traversal Vulnerability

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level permissions. An attacker could exploit this vulnerability by uploading invalid files to an affected device. A successful exploit could allow the attacker to write files in arbitrary locations on the filesystem. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01366 71st percentileScored 2026-11-07
Fix Fixed Cisco Wireless IP Phone 8821 and 8821-EX (Cisco): 11.0(5)Cisco IP Conference Phone 8832 and the rest of the IP Phone 8800 Series (Cisco): 12.5(1)SR1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Wireless IP Phone 8821 and 8821-EXbefore 11.0(5)11.0(5)Patch availableCNA
CiscoCisco IP Conference Phone 8832 and the rest of the IP Phone 8800 Seriesbefore 12.5(1)SR112.5(1)SR1Patch availableCNA
  • Cisco Wireless IP Phone 8821 and 8821-EX VendorCisco Affected before 11.0(5) Fixed in 11.0(5) Patch available CNA
  • Cisco IP Conference Phone 8832 and the rest of the IP Phone 8800 Series VendorCisco Affected before 12.5(1)SR1 Fixed in 12.5(1)SR1 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*before 11.0\(5\)VulnerableCisco
cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*before 11.0\(5\)VulnerableCisco
cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:*:*:*:*:*:*:*:*before 12.5\(1\)sr1VulnerableCisco
cpe:2.3:h:cisco:ip_conference_phone_8832:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*before 12.5\(1\)sr1VulnerableCisco
cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
  • cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:* Versions before 11.0\(5\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:* Versions before 11.0\(5\) Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:*:*:*:*:*:*:*:* Versions before 12.5\(1\)sr1 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ip_conference_phone_8832:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:* Versions before 12.5\(1\)sr1 Vulnerable ·Cisco
  • cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco

Remediation

  • Fix · CNA Cisco Wireless IP Phone 8821 and 8821-EX (Cisco) Fixed in 11.0(5)
  • Fix · CNA Cisco IP Conference Phone 8832 and the rest of the IP Phone 8800 Series (Cisco) Fixed in 12.5(1)SR1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cisco IP Conference Phone 8832 and the rest of the IP Phone 8800 Series, Cisco Wireless IP Phone 8821 and 8821-EX 11.0(5), 12.5(1)SR1

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-01388 Cisco IP Phone 8800 Series Authorization Bypass VulnerabilityPriority MEDIUM 43
    • TI-2019-01389 Cisco IP Phone 8800 Series Cross-Site Request Forgery VulnerabilityPriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1765
  2. 2026-10-03 Alias added: GHSA-2473-cf85-p25m

References

Advisory 1

  • TI-2020-02673 Cisco IP Phone Remote Code Execution and Denial of Service Vulnerability CVSS 3.1HIGH 8.8
  • TI-2019-01388 Cisco IP Phone 8800 Series Authorization Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01261 Cisco IP Phone 7800 Series and 8800 Series Session Initiation Protocol XML Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01389 Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability CVSS 3.0HIGH 8.8
  • TI-2019-01542 Cisco IP Phone 7800 and 8800 Series Session Initiation Protocol Denial of Service Vulnerability CVSS 3.0HIGH 7.5
  • TI-2020-15978 An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences