PT-2019-13567 · Polycom · Polycom Obihai Obi1022

Published 2019-08-01 · Updated 2020-08-24 · CVE-2019-14259

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Polycom Obihai Obi1022 VoIP phone version 5.1.11

Description A command injection issue due to missing input validation in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request to the /Time Service Settings web endpoint, using variables such as NTP server IP address.

Recommendations For Polycom Obihai Obi1022 VoIP phone version 5.1.11, as a temporary workaround, consider restricting access to the "Time Service Settings web" interface until a patch is available. Avoid using the NTP server IP address field in the affected interface until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-14259

Affected Products

Polycom Obihai Obi1022

References · 3

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Obihai_Obi1002.pdf?_=1563787869 · Exploit
• https://osv.dev/vulnerability/CVE-2019-14259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14259 · Security Note