Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2021-1379

Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities

Medium6.5EPSS 0.33%
Published
Updated
Reserved
Assigned by
cisco

Description

Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are due to missing checks when the IP phone processes a Cisco Discovery Protocol or LLDP packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol or LLDP packet to the targeted IP phone. A successful exploit could allow the attacker to execute code on the affected IP phone or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition.Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Timeline

  1. ID reserved

    By cisco

  2. · 4 years later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2021-1379, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:X/RC:X/E:X
NVDNVD · Analyzed3.1Medium6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
0.33% · top 74% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • Cisco · Cisco IP Phones with Multiplatform Firmware

    • affected 11.1.2
    • affected 11.2.1
    • affected 11.2.3
    • affected 11.2.2
    • affected 11.2.3 MSR1-1
    • affected 11.1.2 MSR1-1
    • affected 11.1.1
    • affected 11.1.2 MSR3-1
    • affected 11.0.0
    • affected 11.1.1 MSR1-1
    • affected 11.0.1
    • affected 11.1.1 MSR2-1
    • affected 11.2.4
    • affected 11.0.1 MSR1-1
    • affected 11.0.2
    • affected 11.3.1
    • affected 11.3.1 MSR1-3
    • affected 11.3.2
    • affected 11.3.1 MSR2-6
    • affected 11.3.1 MSR3-3

  • Cisco · Cisco Session Initiation Protocol (SIP) Software

    • affected 9.0(3)
    • affected 9.0(2)SR2
    • affected 9.0(2)SR1
    • affected 9.2(1)
    • affected 9.4(2)SR1
    • affected 9.4(2)
    • affected 9.4(2)SR2
    • affected 9.4(2)SR3
    • affected 9.3(1)SR2
    • affected 9.3(1)SR3
    • affected 9.3(1)SR1
    • affected 9.1(1)SR1
    • affected 9.3(1)SR4
    • affected 9.2(3)
    • affected 9.2(1)SR2
    • affected 9.3(1)
    • affected 9.4(2)SR4
    • affected 12.1(1)SR1
    • affected 11.5(1)
    • affected 10.3(2)
    • affected 10.2(2)
    • affected 10.3(1)
    • affected 10.3(1)SR4
    • affected 11.0(1)
    • affected 10.4(1)SR2 3rd Party
    • affected 11.7(1)
    • affected 12.1(1)
    • affected 11.0(0.7) MPP
    • affected 9.3(4) 3rd Party
    • affected 12.5(1)SR2
    • affected 10.2(1)SR1
    • affected 9.3(4)SR3 3rd Party
    • affected 10.2(1)
    • affected 12.5(1)
    • affected 10.3(1)SR2
    • affected 11-0-1MSR1-1
    • affected 10.4(1) 3rd Party
    • affected 12.5(1)SR1
    • affected 11.5(1)SR1
    • affected 10.1(1)SR2
    • and 40 more

  • Cisco · Cisco Small Business IP Phones

    • affected 7.4.8
    • affected 7.4.3
    • affected 7.5.5a
    • affected 7.3.7
    • affected 7.5.2
    • affected 7.5.1
    • affected 7.4.6
    • affected 7.5.7
    • affected 7.4.4
    • affected 7.6.2SR3
    • affected 7.6.2
    • affected 7.5.6
    • affected 7.5.6c
    • affected 7.6.0
    • affected 7.4.7
    • affected 7.6.2SR6
    • affected 7.5.2b
    • affected 7.5.5
    • affected 7.5.6a
    • affected 7.6.2SR2
    • affected 7.5.3
    • affected 7.5.2a
    • affected 7.5.6(XU)
    • affected 7.5.7s
    • affected 7.6.2SR4
    • affected 7.6.2SR1
    • affected 7.4.9
    • affected 7.5.5b
    • affected 7.6.2SR5
    • affected 7.5.4
    • affected 7.6.1
    • affected 7.6.2SR7

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2021-1379 badge
[![CVE-2021-1379](https://trackcve.app/badge/CVE-2021-1379.svg)](https://trackcve.app/cve/CVE-2021-1379)

Record last updated .