PT-2019-18676 · Lifesize · Lifesize Networker 220+3

Publicado 2019-02-08 · Atualizado 2019-02-08 · CVE-2019-7632

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LifeSize Team, Room, Passport, and Networker 220 devices (affected versions not specified)

Description The issue allows authenticated remote OS command injection. This can be demonstrated by using shell metacharacters in the mtu size parameter of the "support/mtusize.php" API endpoint. In some cases, the default password for the cli account may be used for authentication.

Recommendations For LifeSize Team, Room, Passport, and Networker 220 devices, avoid using the mtu size parameter in the "support/mtusize.php" API endpoint until the issue is resolved. As a temporary workaround, consider changing the default password for the cli account to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-7632

Produtos afetados

Lifesize Networker 220

Lifesize Passport

Lifesize Room

Lifesize Team

Referências · 2

• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=22113 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7632 · Nota de Segurança