PT-2024-22246 · Unify · Unify Cp Ip Phone

Moritz Abrell · Published 2024-04-05 · Updated 2025-03-28 · CVE-2024-28065

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Unify CP IP Phone version 1.10.4.3

Description The issue concerns the lack of encryption for files in the firmware, which results in the exposure of sensitive information, including the root password hash.

Recommendations For Unify CP IP Phone version 1.10.4.3, consider restricting access to sensitive files until a patch is available. As a temporary workaround, limit the use of the firmware to necessary operations only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2024-28065

Affected Products

Unify Cp Ip Phone

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-28065 · Security Note
• https://t.me/cvenotify/116883 · Telegram Post
• https://syss.de · Note
• https://t.me/cvenotify/75853 · Telegram Post
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-007.txt · Note
• https://twitter.com/CVEnew/status/1776313564631867407 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1776350105781551203 · Twitter Post