PT-2019-13567
CVE-2019-14259
·
تاريخ النشر
2019-08-01
·
تاريخ التحديث
2020-08-24
الوصف من
CVSS 3.1
8.0
عاليةالمقاييسAV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Polycom Obihai Obi1022 VoIP phone version 5.1.11
Description
A command injection issue due to missing input validation in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request to the
/Time Service Settings web endpoint, using variables such as NTP server IP address.Recommendations
For Polycom Obihai Obi1022 VoIP phone version 5.1.11, as a temporary workaround, consider restricting access to the "Time Service Settings web" interface until a patch is available. Avoid using the NTP server IP address field in the affected interface until the issue is resolved.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾