CVE-2019-7632

Name of the Vulnerable Software and Affected Versions LifeSize Team, Room, Passport, and Networker 220 devices (affected versions not specified)

Description The issue allows authenticated remote OS command injection. This can be demonstrated by using shell metacharacters in the mtu size parameter of the "support/mtusize.php" API endpoint. In some cases, the default password for the cli account may be used for authentication.

Recommendations For LifeSize Team, Room, Passport, and Networker 220 devices, avoid using the mtu size parameter in the "support/mtusize.php" API endpoint until the issue is resolved. As a temporary workaround, consider changing the default password for the cli account to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.