PT-2019-9272 · Audiocodes · Audiocodes 405Hd

Publicado 2019-04-25 · Atualizado 2019-10-03 · CVE-2018-16216

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AudioCodes 405HD version 2.2.12

Description A command injection issue due to missing input validation and escaping in the monitoring or memory status web interface allows an authenticated remote attacker in the same network as the device to execute OS commands via a POST request to the web server. This can be used to start services like telnetd or open a reverse shell. When combined with another attack that enables unauthenticated password change, the authentication requirement can be circumvented.

Recommendations For AudioCodes 405HD version 2.2.12, consider disabling access to the monitoring or memory status web interface until a patch is available to prevent command injection attacks. Restrict access to the device's web server to minimize the risk of exploitation. Avoid using the web interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-16216

Produtos afetados

Audiocodes 405Hd

Referências · 3

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_AudioCodes_405HD.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-16216 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16216 · Nota de Segurança