6.8

CVE-2021-33478

The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Ip Phone 8800 Firmware Version < 14.0\(1\)
Cisco ≫ Ip Phone 8811 Firmware Version < 14.0\(1\)
Cisco ≫ Ip Phone 8841 Firmware Version < 14.0\(1\)
Cisco ≫ Ip Phone 8845 Firmware Version < 14.0\(1\)
Cisco ≫ Ip Phone 8851 Firmware Version < 14.0\(1\)
Cisco ≫ Ip Phone 8861 Firmware Version < 14.0\(1\)
Cisco ≫ Ip Phone 8865 Firmware Version < 14.0\(1\)
Cisco ≫ Wireless Ip Phone 8821 Firmware Version < 11.0\(6\)sr1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.13% 0.344
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.8 0.9 5.9
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.