CVE-2018-0341

A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remote attacker to perform a command injection and execute commands with the privileges of the web server. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including arbitrary shell commands in a specific user input field. Cisco Bug IDs: CSCvi51426.

• CWE-77
• CWE-78

• http://www.securityfocus.com/bid/104731Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041285Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-phone-webui-injectVendor Advisory
• http://www.securityfocus.com/bid/104731Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041285Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-phone-webui-injectVendor Advisory

Published

Jul 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0335A vulnerability in the web portal authentication process of …
• CVE-2018-0336A vulnerability in the batch provisioning feature of Cisco P…
• CVE-2018-0337A vulnerability in the role-based access-checking mechanisms…7.8
• CVE-2018-0338A vulnerability in the role-based access-checking mechanisms…7.8
• CVE-2018-0339A vulnerability in the web-based management interface of Cis…
• CVE-2018-0340A vulnerability in the web framework of the Cisco Unified Co…
• CVE-2018-0342A vulnerability in the configuration and monitoring service …
• CVE-2018-0343A vulnerability in the configuration and management service …
• CVE-2018-0344A vulnerability in the vManage dashboard for the configurati…
• CVE-2018-0345A vulnerability in the configuration and management database…8.8
• CVE-2018-0346A vulnerability in the Zero Touch Provisioning service of th…
• CVE-2018-0347A vulnerability in the Zero Touch Provisioning (ZTP) subsyst…