CVE-2018-16220

Name of the Vulnerable Software and Affected Versions AudioCodes 405HD VoIP phone version 2.2.12

Description The issue allows an attacker to inject JavaScript into the web interface by manipulating phone book entries or the domain name sent from the domain controller, affecting the device's domain field and personal settings. This can be exploited by a local or remote attacker.

Recommendations For AudioCodes 405HD VoIP phone version 2.2.12, consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using the phone book entries and domain name fields in the web interface to minimize the risk of exploitation.