A security issue has been reported in Cisco IP Phone 7921, which potentially can be exploited by malicious people to disclose sensitive information.

The problem is that server certificates are not validated when using the PEAP protocol. This can be exploited to e.g. gain knowledge of authentication credentials when a user is tricked into connecting to a malicious authentication server.

Solution
The vendor is reportedly working on a update and recommends using EAP-TLS instead of PEAP.

Provided and/or discovered by
Unknown researchers reported via ZDNet's Zero Day blog.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area