PT-2020-10320 · Nec · Sv9100+4

Published 2020-07-29 · Updated 2020-08-04 · CVE-2019-20027

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEC PBXes versions 7.0 and higher

Description The issue concerns NEC PBXes, including the SV8100, SV9100, SL1100, and SL2100, where if incorrectly configured, a blank username and password combination can be entered as a valid account, successfully authenticating.

Recommendations For versions 7.0 and higher, ensure proper configuration to prevent the acceptance of blank username and password combinations as valid authentication credentials.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-20027

Affected Products

Nec Pbxes

Sl1100

Sl2100

Sv8100

Sv9100

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-20027 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20027 · Vendor Advisory
• https://shadytel.su/files/nec_cve.txt · Note
• https://t.me/cibsecurity/13751 · Telegram Post