PT-2020-10325 · Nec · Sv9100+5

Published 2020-07-29 · Updated 2020-08-03 · CVE-2019-20032

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NEC PBXes versions of SV8100, SV9100, SL1100, and SL2100

Description An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes may access the system's administration modem.

Recommendations For all versions of SV8100, SV9100, SL1100, and SL2100 devices, consider restricting access to the InMail voicemail box and the find me/follow me feature until a patch is available. As a temporary workaround, consider disabling the find me/follow me feature on the affected devices to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2019-20032

Affected Products

Aspire

Winmail

Sl1100

Sl2100

Sv8100

Sv9100

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-20032 · Security Note
• https://t.me/cibsecurity/13746 · Telegram Post
• https://shadytel.su/files/nec_cve.txt · Note