PT-2019-12754 · Htek · Htek Uc902

Published 2019-07-22 · Updated 2022-04-18 · CVE-2019-12325

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Htek UC902 VoIP phone version 2.0.4.4.46

Description The issue concerns buffer overflow vulnerabilities in the web management interface of the Htek UC902 VoIP phone. These vulnerabilities can be exploited to crash the device, resulting in a denial of service (DoS), or to execute code, allowing an attacker to spawn a remote shell as a root user. The exploitation of these vulnerabilities can occur without authentication for a DoS attack, or with user authentication for code execution.

Recommendations For version 2.0.4.4.46, consider restricting access to the web management interface until a patch is available to prevent potential exploitation. As a temporary workaround, limit user authentication to essential personnel to minimize the risk of code execution.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-12325

Affected Products

Htek Uc902

References · 3

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Htek_UC902.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12325 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12325 · Vendor Advisory