« Volver al listado

CVE-2021-33478

Estado: ModificadaMedia (6.8)—

The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (15)

Cisco — IP Phone 8800 FirmwareCisco — IP Phone 8800 Series With Multiplatform FirmwareCisco — IP Phone 8811 FirmwareCisco — IP Phone 8811 With Multiplatform FirmwareCisco — IP Phone 8841 FirmwareCisco — IP Phone 8841 With Multiplatform FirmwareCisco — IP Phone 8845 FirmwareCisco — IP Phone 8845 With Multiplatform FirmwareCisco — IP Phone 8851 FirmwareCisco — IP Phone 8851 With Multiplatform FirmwareCisco — IP Phone 8861 FirmwareCisco — IP Phone 8861 With Multiplatform FirmwareCisco — IP Phone 8865 FirmwareCisco — IP Phone 8865 With Multiplatform FirmwareCisco — Wireless IP Phone 8821 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-33478",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-22T17:15:09.510",
  "references": [
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-brcm-mxc-jul2021-26LqUZUh",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-brcm-mxc-jul2021-26LqUZUh",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achieve arbitrary code execution in the TrustZone Trusted Execution Environment (TEE) of an affected device. This, for example, affects certain Cisco IP Phone and Wireless IP Phone products before 2021-07-07. Exploitation is possible only when the attacker can disassemble the device in order to control the voltage/current for chip pins."
    },
    {
      "lang": "es",
      "value": "La implementación de TrustZone en determinados firmware de Broadcom MediaxChange, podría permitir a un atacante no autenticado y físicamente próximo lograr la ejecución de código arbitrario en el TrustZone Trusted Execution Environment (TEE) de un dispositivo afectado. Esto, por ejemplo, afecta a determinados productos Cisco IP Phone y Wireless IP Phone anteriores a 2021-07-07. Una explotación es posible sólo cuando el atacante puede desarmar el dispositivo para controlar el voltaje y corriente de los pines del chip"
    }
  ],
  "lastModified": "2026-06-17T03:54:37.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D455DEFE-21EB-4097-80DE-15E64D693B83",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8800_series_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAFADE09-8296-4358-B7B2-3A1DB820F942",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8811_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A479FA93-5249-4BEE-8FC1-3C9BBC0F8AB4",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8811_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90C80E75-CE8A-48A7-9BA9-6F75DBC8DF30",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8841_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30778C3F-B616-428D-A53F-18C6345B8176",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8841_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DD84FA6-82D0-4777-8FB9-9B2B09374B0A",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8845_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42F08B4A-7F01-4145-B410-0E85F1CE19D9",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8845_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B8B2074-1F1E-4F03-BEAF-960DDA712592",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8851_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1888843-83FC-4DCC-9247-1128920DE996",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8851_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15DBBC70-588B-44F8-815B-A63CD19A892D",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8861_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C16E5F2C-ADBB-44A7-AAB3-8AF0CD186624",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8861_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AEBD7B8-B8E9-454C-814E-706D7F6A19F4",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8865_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E5DB741-7AEC-4BA7-80BB-BC784F849C48",
              "versionEndExcluding": "14.0\\(1\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ip_phone_8865_with_multiplatform_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC3583AE-9C80-4666-A71A-D2E0ACC0D620",
              "versionEndExcluding": "11.3\\(4\\)"
            },
            {
              "criteria": "cpe:2.3:o:cisco:wireless_ip_phone_8821_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48D89E05-BD89-45E1-9D3C-FCC8B09A3D61",
              "versionEndExcluding": "11.0\\(6\\)sr1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}