Command Injection Vulnerability in Akuvox R50P VoIP Phone
CVE-2019-12324

7.2HIGH

Key Information:

Vendor

Akuvox

Status
Sp-r50p Firmware
Vendor
CVE Published:
22 July 2019

What is CVE-2019-12324?

A command injection vulnerability exists in the IP address field for the logging server within the configuration web interface of the Akuvox R50P VoIP phone. This issue arises due to insufficient input validation, which permits authenticated remote attackers on the same network to craft malicious POST requests containing shell metacharacters. Consequently, attackers could execute arbitrary OS commands, potentially leading to system compromise and unauthorized access.

References

https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Adv...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.