PT-2019-4243 · Cisco · Cisco Unity Express

Publicado 2019-11-20 · Atualizado 2021-10-29 · CVE-2019-15986

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unity Express (affected versions not specified)

Description The issue is related to the improper handling of special elements, which can be exploited to elevate privileges and execute arbitrary code. An authenticated, local attacker could inject arbitrary commands that are executed with root privileges by sending crafted CLI commands to the system. This is due to improper input validation for certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

BDU:2019-04844

CVE-2019-15986

Produtos afetados

Cisco Unity Express

Referências · 4

• https://bdu.fstec.ru/vul/2019-04844 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15986 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15986 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-unity-exp-comm-inject · Aviso do Fabricante