10

CVE-2014-2650

Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atos ≫ Openstage 80 Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 80 Version -
Atos ≫ Openstage 80 G Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 80 G Version -
Atos ≫ Openstage 60 G Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 60 G Version -
Atos ≫ Openstage 60 Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 60 Version -
Atos ≫ Openstage 40 Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 40 Version -
Atos ≫ Openstage 40 G Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 40 G Version -
Atos ≫ Openstage 20 E Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 20 E Version -
Atos ≫ Openstage 20 Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 20 Version -
Atos ≫ Openstage 20 G Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 20 G Version -
Atos ≫ Openstage 15 Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 15 Version -
Atos ≫ Openstage 15 G Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 15 G Version -
Atos ≫ Openstage 5 Firmware Version v3 Update r3.11.0
   Atos ≫ Openstage 5 Version -
Atos ≫ Openscape Desk Phone Ip 35g Firmware Version v3 Update r3.11.0
   Atos ≫ Openscape Desk Phone Ip 35g Version -
Atos ≫ Openscape Desk Phone Ip 35g Eco Firmware Version v3 Update r3.11.0
Atos ≫ Openscape Desk Phone Ip 55g Firmware Version v3 Update r3.11.0
   Atos ≫ Openscape Desk Phone Ip 55g Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.57% 0.832
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx
Third Party Advisory
https://networks.unify.com/security/advisories/OBSO-1403-01.pdf
Vendor Advisory