Login Request a demo
Medium severity · published Jul 22, 2021
CVE-2021-33478
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the…
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
IP Phone 8800 Firmware · Cisco
before 14.0\(1\) · source: NVD
IP
IP Phone 8800 Series With Multiplatform Firmware · Cisco
before 11.3\(4\) · source: NVD
IP
IP Phone 8811 Firmware · Cisco
before 14.0\(1\) · source: NVD
IP
IP Phone 8811 With Multiplatform Firmware · Cisco
before 11.3\(4\) · source: NVD
IP
IP Phone 8841 Firmware · Cisco
before 14.0\(1\) · source: NVD
IP
IP Phone 8841 With Multiplatform Firmware · Cisco
before 11.3\(4\) · source: NVD
IP
IP Phone 8845 Firmware · Cisco
before 14.0\(1\) · source: NVD
IP
IP Phone 8845 With Multiplatform Firmware · Cisco
before 11.3\(4\) · source: NVD
IP
IP Phone 8851 Firmware · Cisco
before 14.0\(1\) · source: NVD
IP
IP Phone 8851 With Multiplatform Firmware · Cisco
before 11.3\(4\) · source: NVD
IP
IP Phone 8861 Firmware · Cisco
before 14.0\(1\) · source: NVD
IP
IP Phone 8861 With Multiplatform Firmware · Cisco
before 11.3\(4\) · source: NVD
Affected product
IP
IP Phone 8800 Firmware
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33478
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-brcm-mxc-jul2021-26LqUZUh
More from IP Phone 8800 Firmware
9.8
CVE-2019-1716
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an…
8.8
CVE-2019-1764
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker…
7.5
CVE-2019-1766
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker…
7.5
CVE-2019-1763
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker…
7.5
CVE-2018-0325
A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones could allow an…