CVE-2019-12948

Опубликовано: 29 июл. 2019

Источник: nvd

CVSS3: 8.3

CVSS2: 6.5

EPSS Низкий

Описание

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*

Версия до 5.8.5.1256 (исключая)

cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*

Версия от 5.9.3 (включая) до 5.9.3.2857 (исключая)

cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.0.4839 (исключая)

Одно из

cpe:2.3:h:polycom:c12:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:c16:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:c8:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx150:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx201:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx250:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx301:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx311:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx350:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx401:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx411:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx450:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx501:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx601:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*

Версия до 5.9.0 (исключая)

Одно из

cpe:2.3:h:polycom:trio_8500:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:trio_8800:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*

Версия до 4.0.14.1580 (исключая)

Одно из

cpe:2.3:h:polycom:soundpoint_ip_300:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_301:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_320:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_321:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_330:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_331:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_335:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_430:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_450:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_500:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_501:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_550:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_560:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_600:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_601:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_650:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_ip_670:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_pro_se-220:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundpoint_pro_se-225:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_duo:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_ip_4000:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_ip_5000:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_ip_6000:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_ip_7000:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_ip_7000_video_integration:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation_vtx_1000:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation2:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation2_avaya_2490:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation2_direct_connect_for_nortel:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:soundstation2w:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

Одно из

cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*

Версия до 5.8.5.1256 (исключая)

cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*

Версия от 5.9.3 (включая) до 5.9.3.2857 (исключая)

Одно из

cpe:2.3:h:polycom:vvx300:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx310:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx400:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx410:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx500:-:*:*:*:*:*:*:*

cpe:2.3:h:polycom:vvx600:-:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01194

Низкий

8.3 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-749

Связанные уязвимости

GHSA-5wpv-2g59-v5gg

CVSS3: 8.3

github

больше 3 лет назад

An RCE (Remote Code Execution) vulnerability exists in the UCS software through 6.0.0 used by Polycom Products. The vulnerability could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability by authenticating to the affected system and uploading an arbitrary file.

EPSS

Процентиль: 79%

0.01194

Низкий

8.3 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-749