PT-2019-9277 · Audiocodes · Audiocodes 405Hd Voip Phone

Published 2019-04-25 · Updated 2019-04-26 · CVE-2018-16220

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AudioCodes 405HD VoIP phone version 2.2.12

Description The issue allows an attacker to inject JavaScript into the web interface by manipulating phone book entries or the domain name sent from the domain controller, affecting the device's domain field and personal settings. This can be exploited by a local or remote attacker.

Recommendations For AudioCodes 405HD VoIP phone version 2.2.12, consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using the phone book entries and domain name fields in the web interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-16220

Affected Products

Audiocodes 405Hd Voip Phone

References · 3

• https://osv.dev/vulnerability/CVE-2018-16220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16220 · Security Note
• https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_AudioCodes_405HD.pdf · Note