Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-5532: Cisco 9900 phones web interface can be crashed

CVE-2013-5532 · published 13 years ago

Summary

Cisco 9900 series IP phones, including models 9951 and 9971, have a flaw in their web‑application interface that can be triggered by sending overly long data. An attacker could use this to make the phone's web interface stop working, effectively denying service to anyone trying to manage the device. Apply the latest firmware updates from Cisco as soon as possible to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	unified_ip_phones_9900_series_firmware	All versions `cpe:2.3:o:cisco:unified_ip_phones_9900_series_firmware:-:::::::*`
cisco	unified_ip_phone_9951	All versions `cpe:2.3:h:cisco:unified_ip_phone_9951::::::::`
cisco	unified_ip_phone_9971	All versions `cpe:2.3:h:cisco:unified_ip_phone_9971::::::::`

Original advisory text

Buffer overflow in the web-application interface on Cisco 9900 IP phones allows remote attackers to cause a denial of service (webapp interface outage) via long values in unspecified fields, aka Bu...

References

http://osvdb.org/98338
http://secunia.com/advisories/55275
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5532 Vendor Advisory
http://www.securityfocus.com/bid/62944 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published11 Oct 2013

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2013-5532 · NVD

Track software like this

Free during beta