PT-2020-10322 · Nec · Sv9100+4

Published 2020-07-29 · Updated 2021-07-21 · CVE-2019-20029

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Aspire-derived NEC PBXes versions (affected versions not specified) SV8100 versions (affected versions not specified) SV9100 versions (affected versions not specified) SL1100 versions (affected versions not specified) SL2100 versions (affected versions not specified)

Description A privilege escalation issue exists in the WebPro functionality, allowing a specially crafted HTTP POST to cause escalation to a higher privileged account, including an undocumented developer level of access.

Recommendations For Aspire-derived NEC PBXes, consider restricting access to the WebPro functionality until a fix is available. For SV8100, SV9100, SL1100, and SL2100 devices, avoid using the WebPro functionality with untrusted input until the issue is resolved. As a temporary workaround, consider disabling the WebPro functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-20029

Affected Products

Aspire-Derived Nec Pbxes

Sl1100

Sl2100

Sv8100

Sv9100

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-20029 · Security Note
• https://shadytel.su/files/nec_cve.txt · Note
• https://t.me/cibsecurity/13749 · Telegram Post