PT-2019-18676 · Lifesize · Lifesize Networker 220+3
Published
2019-02-08
·
Updated
2019-02-08
·
CVE-2019-7632
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
LifeSize Team, Room, Passport, and Networker 220 devices (affected versions not specified)
Description
The issue allows authenticated remote OS command injection. This can be demonstrated by using shell metacharacters in the
mtu size parameter of the "support/mtusize.php" API endpoint. In some cases, the default password for the cli account may be used for authentication.Recommendations
For LifeSize Team, Room, Passport, and Networker 220 devices, avoid using the
mtu size parameter in the "support/mtusize.php" API endpoint until the issue is resolved. As a temporary workaround, consider changing the default password for the cli account to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lifesize Networker 220
Lifesize Passport
Lifesize Room
Lifesize Team