CVE-2019-14259

Name of the Vulnerable Software and Affected Versions Polycom Obihai Obi1022 VoIP phone version 5.1.11

Description A command injection issue due to missing input validation in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request to the /Time Service Settings web endpoint, using variables such as NTP server IP address.

Recommendations For Polycom Obihai Obi1022 VoIP phone version 5.1.11, as a temporary workaround, consider restricting access to the "Time Service Settings web" interface until a patch is available. Avoid using the NTP server IP address field in the affected interface until the issue is resolved.