CVE-2013-6685

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

The firmware on Cisco Unified IP phones 8961, 9951, and 9971 uses weak permissions for memory block devices, which allows local users to gain privileges by mounting a device with a setuid file in its filesystem, aka Bug ID CSCui04382.

Metrics

CVSS 2.0 6.6/10AV:L/AC:M/Au:S/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2013
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-66866.8The SSL VPN implementation in Cisco IOS 15.3(1)T2 and earlier allows remote authenticated users to cause a denial of service (interface queuCVE-2013-66874.0The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the CVE-2013-66886.3Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager (ELM) component in Cisco Unified CommuniCVE-2013-66896.9Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier allows local users to bypass file permissions, and read, modify, or creCVE-2013-66904.3Multiple cross-site scripting (XSS) vulnerabilities in the web interface in the Assurance component in Cisco Prime Collaboration allow remotCVE-2013-66916.8The WebVPN CIFS implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0(.4.1) and earlier allows remote CIFS servers to causeCVE-2013-66926.3Cisco IOS XE 3.8S(.2) and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated usCVE-2013-66935.4The MLDP implementation in Cisco IOS 15.3(3)S and earlier on 7600 routers, when many VRFs are configured, allows remote attackers to cause aCVE-2013-66944.3The IPSec implementation in Cisco IOS allows remote attackers to cause a denial of service (MTU change and tunnel-session drop) via crafted CVE-2013-66954.0The RBAC implementation in Cisco Secure Access Control System (ACS) does not properly verify privileges for support-bundle downloads, which CVE-2013-66967.1Cisco Adaptive Security Appliance (ASA) Software does not properly handle errors during the processing of DNS responses, which allows remoteCVE-2013-66984.3The web interface on Cisco Wireless LAN Controller (WLC) devices does not properly restrict use of IFRAME elements, which makes it easier fo