What’s Vulnerable › Vulnerabilities

CVE-2013-3426

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-07-18 · updated 2026-06-16
• Weakness: CWE-264

Description

The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files by specifying a pathname in a file request, aka Bug ID CSCuh52810.

Affected products

• Cisco Unified Ip Phone 9951: all versions
• Cisco Unified Ip Phone 9971: all versions
• Cisco Unified Ip Phones 9900 Series Firmware: all versions

References

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3426
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3426

Get alerted when CVE-2013-3426 or the next vulnerability affects your stack