PT-2020-7314 · Polycom · Polycom Hdx Video End Points

Heyder Andrade + 1 · Published 2020-01-28 · Updated 2020-02-04 · CVE-2012-6610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Polycom HDX Video End Points versions prior to 3.0.4 UC APL versions prior to 2.7.1.J

Description: The issue allows remote authenticated users to execute arbitrary commands. This can be demonstrated by appending a semicolon to the ping command feature, which enables the execution of additional commands.

Recommendations: For Polycom HDX Video End Points versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. For UC APL versions prior to 2.7.1.J, update to version 2.7.1.J or later to resolve the issue. As a temporary workaround, consider restricting access to the ping command feature to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2012-6610

Affected Products

Polycom Hdx Video End Points

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-6610 · Security Note
• http://seclists.org/fulldisclosure/2012/Mar/18 · Note
• https://t.me/cvenotify/529 · Telegram Post
• https://web.archive.org/web/20130317232013/http://blog.tempest.com.br/joao-paulo-campello/polycom-web-management-interface-os-command-injection.html · Note