CVE-2021-1379
CVE-2021-1379 is a medium-severity vulnerability in Cisco Ip Conference Phone 7832 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-120.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 0% (23rd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2021-6846
- Weakness: CWE-120
- Affected product: Cisco Ip Conference Phone 7832 Firmware
- Published:
- Last modified:
Description
Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are due to missing checks when the IP phone processes a Cisco Discovery Protocol or LLDP packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol or LLDP packet to the targeted IP phone. A successful exploit could allow the attacker to execute code on the affected IP phone or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition.Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Frequently asked questions
- What is CVE-2021-1379?
- Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are due to missing checks when the IP phone processes a Cisco Discovery Protocol or LLDP packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol or LLDP packet to the targeted IP phone. A successful exploit could allow the attacker to execute code on the affected IP phone or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition.Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
- How severe is CVE-2021-1379?
- CVE-2021-1379 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2021-1379 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-1379?
- CVE-2021-1379 primarily affects Cisco Ip Conference Phone 7832 Firmware. In total, 52 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-1379?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2021-1379 have an EU (EUVD) identifier?
- Yes. CVE-2021-1379 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-6846.
- When was CVE-2021-1379 published?
- CVE-2021-1379 was published on 2024-11-18 and last updated on 2026-06-17.
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-rce-dos-U2PsSkz3
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-distupd-N87eB6Z3
Affected products (52)
- cpe:2.3:o:cisco:ip_conference_phone_7832_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_conference_phone_7832_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_conference_phone_7832_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_conference_phone_8832_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_6821_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_6841_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_6851_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_6861_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_6871_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7811_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7811_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7811_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7821_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7821_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7821_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7841_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7841_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7841_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7861_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7861_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_7861_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8811_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8841_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8851_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8861_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8845_firmware:12.8\(1\):-:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8845_with_multiplatform_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:cisco:ip_phone_8865_firmware:12.8\(1\):-:*:*:*:*:*:*
More vulnerabilities in Cisco Ip Conference Phone 7832 Firmware
- CVE-2020-3111 — High (CVSS 8.8): A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated,…
- CVE-2019-1635 — High (CVSS 7.5): A vulnerability in the call-handling functionality of Session Initiation Protocol (SIP) Software for Cisco IP Phone…
- CVE-2019-1684 — Medium (CVSS 6.5): A vulnerability in the Cisco Discovery Protocol or Link Layer Discovery Protocol (LLDP) implementation for the Cisco IP…
- CVE-2021-34711 — Medium (CVSS 5.5): A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any…
- CVE-2024-20445 — Medium (CVSS 5.3): A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video…
- CVE-2019-1922 — Medium (CVSS 5.3): A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an…
All CVEs affecting Cisco Ip Conference Phone 7832 Firmware →
Other CWE-120 (Classic Buffer Overflow) vulnerabilities
- CVE-2025-48611 — Critical (CVSS 10.0): In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead…
- CVE-2026-24823 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT…
- CVE-2026-24810 — Critical (CVSS 10.0): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules).…
- CVE-2026-24800 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow…
- CVE-2025-9962 — Critical (CVSS 10.0): A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior…
- CVE-2010-10016 — Critical (CVSS 10.0): BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u…
Browse all CWE-120 (Classic Buffer Overflow) vulnerabilities →