PT-2019-13567 · Polycom · Polycom Obihai Obi1022

Publicado 2019-08-01 · Atualizado 2020-08-24 · CVE-2019-14259

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Polycom Obihai Obi1022 VoIP phone version 5.1.11

Description A command injection issue due to missing input validation in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request to the /Time Service Settings web endpoint, using variables such as NTP server IP address.

Recommendations For Polycom Obihai Obi1022 VoIP phone version 5.1.11, as a temporary workaround, consider restricting access to the "Time Service Settings web" interface until a patch is available. Avoid using the NTP server IP address field in the affected interface until the issue is resolved.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-14259

Produtos afetados

Polycom Obihai Obi1022

Referências · 3

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Obihai_Obi1002.pdf?_=1563787869 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14259 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14259 · Nota de Segurança