CVE-2014-9563

Опубликовано: 12 апр. 2018

Источник: nvd

CVSS3: 4.9

CVSS2: 4

EPSS Низкий

Описание

CRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd.

Ссылки

https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
Vendor Advisory
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
Third Party Advisory
https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
Vendor Advisory
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:unify:openstage_sip:*:*:*:*:*:*:*:*

Версия до r3.32.0 (исключая)

Одно из

cpe:2.3:h:unify:openstage_20:-:*:*:*:*:*:*:*

cpe:2.3:h:unify:openstage_40:-:*:*:*:*:*:*:*

cpe:2.3:h:unify:openstage_60:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:unify:openscape_desk_phone_ip_sip:*:*:*:*:*:*:*:*

Версия до r3.32.0 (исключая)

Одно из

cpe:2.3:h:atos:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*

cpe:2.3:h:atos:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*

cpe:2.3:h:atos:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*

EPSS

Процентиль: 39%

0.0017

Низкий

4.9 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-93

Связанные уязвимости

GHSA-cf58-jjq5-73mm