PT-2019-9277 · Audiocodes · Audiocodes 405Hd Voip Phone

Publicado 2019-04-25 · Atualizado 2019-04-26 · CVE-2018-16220

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AudioCodes 405HD VoIP phone version 2.2.12

Description The issue allows an attacker to inject JavaScript into the web interface by manipulating phone book entries or the domain name sent from the domain controller, affecting the device's domain field and personal settings. This can be exploited by a local or remote attacker.

Recommendations For AudioCodes 405HD VoIP phone version 2.2.12, consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using the phone book entries and domain name fields in the web interface to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-16220

Produtos afetados

Audiocodes 405Hd Voip Phone

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-16220 · Aviso do Fabricante
• https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_AudioCodes_405HD.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16220 · Nota de Segurança