Read the docs
TI-2021-12882 Aliases CVE-2021-33478GHSA-vh28-q6j2-63w7

The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an…

Priority LOW 30CWE-119Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.

Why it matters now

EPSS 0.00304 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8800_series_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8845_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
  • cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8800_series_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8845_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*before 14.0\(1\)VulnerableCisco
cpe:2.3:o:cisco:ip_phone_8865_with_multiplatform_firmware:*:*:*:*:*:*:*:*before 11.3\(4\)VulnerableCisco
cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*before 11.0\(6\)sr1VulnerableCisco
  • cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:* Versions before 14.0\(1\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:ip_phone_8865_with_multiplatform_firmware:*:*:*:*:*:*:*:* Versions before 11.3\(4\) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:* Versions before 11.0\(6\)sr1 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33478
  2. 2026-10-03 Alias added: GHSA-vh28-q6j2-63w7

References

Advisory 1

  • TI-2019-01342 Cisco IP Phone 7800 Series and 8800 Series Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2018-00284 Improper input validation in Cisco IP Phone 7800 Series and 8800 Series CVSS 3.0HIGH 7.5
  • TI-2019-01388 Cisco IP Phone 8800 Series Authorization Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01391 Cisco IP Phone 8800 Series File Upload Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01389 Cisco IP Phone 8800 Series Cross-Site Request Forgery Vulnerability CVSS 3.0HIGH 8.8
  • TI-2023-06727 Authentication bypass in Cisco Session Initiation Protocol Software CVSS 3.1HIGH 8.6
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences