{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Unified IP Phones 7900 Series.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified IP Conference Station 7935 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Unified IP Conference Station 7936 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDeux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans Cisco Unified IP Conference\nStation et Cisco Unified IP Phones :\n\n-   la premi\u00e8re est due \u00e0 une mauvaise gestion des sessions de\n    l\u0027administrateur sur l\u0027interface web de gestion de l\u0027\u00e9quipement.\n    L\u0027exploitation de cette vuln\u00e9rabilit\u00e9 permet d\u0027acc\u00e9der directement\n    aux URL de gestion ;\n-   la deuxi\u00e8me est due \u00e0 l\u0027existence d\u0027un compte par d\u00e9faut permettant\n    d\u0027acc\u00e9der \u00e0 l\u0027interface d\u0027administration en ligne de commande (CLI).\n    L\u0027exploitation de cette vuln\u00e9rabilit\u00e9 permet d\u0027acc\u00e9der au t\u00e9l\u00e9phone\n    IP vuln\u00e9rable et d\u0027ex\u00e9cuter des commandes conduisant \u00e0 un d\u00e9ni de\n    service et/ou une \u00e9l\u00e9vation de privil\u00e8ges.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2007-02-22T00:00:00",
  "last_revision_date": "2007-02-22T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco ID 81786 du 21 f\u00e9vrier 2007 :",
      "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco ID 82080 du 21 f\u00e9vrier 2007 :",
      "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"
    }
  ],
  "reference": "CERTA-2007-AVI-098",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-02-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s affectent les \u00e9quipement des gammes Cisco Unified IP\nConference Station et Cisco Unified IP Phones, permettant un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les \u00e9quipements CISCO Unified IP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 CISCO du 21 f\u00e9vrier 2007",
      "url": null
    }
  ]
}