8.1

CVE-2014-8422

The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Unify ≫ Openstage Sip Version < r3.32.0
   Unify ≫ Openstage 20 Version -
   Unify ≫ Openstage 40 Version -
   Unify ≫ Openstage 60 Version -
Unify ≫ Openscape Desk Phone Ip Sip Version < r3.32.0
   Atos ≫ Openscape Desk Phone Ip 35g Version -
   Atos ≫ Openscape Desk Phone Ip 35g Eco Version -
   Atos ≫ Openscape Desk Phone Ip 55g Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.6% 0.738
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
Vendor Advisory
Mitigation
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
Third Party Advisory