CVE-2018-18568

Опубликовано: 24 окт. 2018

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

Ссылки

https://seclists.org/bugtraq/2018/Oct/36
Exploit
Mailing List
Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-027.txt
Exploit
Third Party Advisory
https://seclists.org/bugtraq/2018/Oct/36
Exploit
Mailing List
Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-027.txt
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*

Версия до 5.8.0.12848 (включая)

Конфигурация 2

Одновременно

cpe:2.3:o:polycom:vvx_601_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx_601:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:polycom:vvx_500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx_500:-:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00133

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-9g4x-h99q-xhpc