PT-2020-9192 · Poly · Poly Hdx

Published 2020-03-12 · Updated 2020-03-18 · CVE-2019-11355

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Poly (formerly Polycom) HDX version 3.1.13

Description An issue exists in the administrator's page, where a feature allows the creation or upload of server/client certificates. The user-input value is used in a shell script on the equipment, and by entering a special character, such as a single quote, in a CN or other CSR field, a command can be inserted into a factor value. This allows a system command to be executed as root.

Recommendations For Poly (formerly Polycom) HDX version 3.1.13, consider restricting access to the certificate creation and upload feature on the administrator's page until a fix is available. As a temporary workaround, avoid using special characters in CN or CSR fields to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-11355

Affected Products

Poly Hdx

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-11355 · Security Note
• https://support.polycom.com/content/dam/polycom-support/global/documentation/hdx-3-1-14-advisory.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11355 · Vendor Advisory
• https://t.me/cvenotify/1611 · Telegram Post