PT-2019-10993 · Audiocodes · Audiocodes 450Hd Ip Phone
Spencer Gietzen
·
Published
2019-04-01
·
Updated
2019-04-04
·
CVE-2018-5757
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
AudioCodes 450HD IP Phone version 3.0.0.535.106
Description:
An issue was discovered where the traceroute and ping functionality in the Monitoring page of the web UI uses a parameter in a request to
command.cgi that unsafely puts user-alterable data directly into an OS command. This leads to remote code execution via shell metacharacters in the query string.Recommendations:
For AudioCodes 450HD IP Phone version 3.0.0.535.106, consider restricting access to the Monitoring page in the web UI and the
command.cgi endpoint to minimize the risk of exploitation. Avoid using the parameter in the request to command.cgi that allows user-alterable data to be put into an OS command until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Audiocodes 450Hd Ip Phone