{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T09:59:55Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20130828-CVE-2013-3468","slug":"cisco-sa-20130828-cve-2013-3468","vendor":"Cisco","title":"Cisco Unified IP Phone 8945 Crafted PNG Image Lockup Vulnerability","summary":"A vulnerability in PNG image processing of the Cisco Unified IP Phone 8945 running software version 9.3(2) could allow an unauthenticated, remote attacker to cause the phone to lock up. The vulnerability is due to incorrect processing of malformed PNG images. An attacker could exploit this vulnerability by placing a malicious PNG image on the HTTP Server from which the phone requests XML files. A successful exploit could allow the attacker to cause the phone to lock up. Cisco has confirmed the vulnerability in a security notice and software updates are available. To exploit this vulnerability, it is likely that an attacker would need access to trusted, internal networks and access to the HTTP server on the network that serves resources to an affected device. These access requirements limits the likelihood of a successful exploit.","severity":"Medium","published_at":"2013-08-28T19:57:33Z","updated_at":"2013-08-28T19:57:33Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130828-CVE-2013-3468","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20130828-CVE-2013-3468/csaf/Cisco-SA-20130828-CVE-2013-3468.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":1,"public_evidence_count":1,"kev_count":0,"highest_epss":0.03172},"cves":[{"id":"CVE-2013-3468","kev":false,"epss":{"score":0.03172,"percentile":0.86619,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}}],"public_evidence":[{"product":{"name":"Cisco Unified IP Phone 8945","slug":"cisco-unified-ip-phone-8945","vendor":"Cisco"},"cve":{"id":"CVE-2013-3468"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:17:47Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Unified IP Phone 8945","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.03172,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2013-08-28T19:57:33Z","updated_at":"2013-08-28T19:57:33Z","advisory_updated_at":"2013-08-28T19:57:33Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130828-CVE-2013-3468","row_display_order":1}]}