PT-2019-12753 · Akuvox · Akuvox R50P Voip Phone

Publicado 2019-07-22 · Atualizado 2020-08-24 · CVE-2019-12324

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Akuvox R50P VoIP phone version 50.0.6.156

Description A command injection issue due to missing input validation in the IP address field for the logging server in the configuration web interface allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request to the / API endpoint, specifically targeting the logging server ip variable.

Recommendations For Akuvox R50P VoIP phone version 50.0.6.156, as a temporary workaround, consider disabling the logging server configuration feature until a patch is available. Restrict access to the configuration web interface to minimize the risk of exploitation. Avoid using shell metacharacters in the IP address field for the logging server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-12324

Produtos afetados

Akuvox R50P Voip Phone

Referências · 3

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12324 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12324 · Aviso do Fabricante