Command Injection Vulnerability in Polycom VoIP Phone
CVE-2019-14259

8HIGH

Key Information:

Vendor

Polycom

Status
Obihai Obi1022 Firmware
Vendor
CVE Published:
1 August 2019

What is CVE-2019-14259?

The Polycom Obi1022 VoIP phone, running firmware version 5.1.11, has a vulnerability that allows an authenticated remote attacker on the same network to exploit a command injection flaw in the NTP server IP address field. This flaw arises from inadequate input validation in the 'Time Service Settings' web interface, allowing attackers to execute arbitrary operating system commands through crafted POST requests.

References

https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Adv...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.