4.9
CVE-2014-9563
- EPSS 0.17%
- Veröffentlicht 12.04.2018 21:29:00
- Zuletzt bearbeitet 21.11.2024 02:21:08
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCRLF injection vulnerability in the web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via the ssh-password parameter to page.cmd.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Unify ≫ Openstage Sip Version < r3.32.0
Unify ≫ Openscape Desk Phone Ip Sip Version < r3.32.0
Atos ≫ Openscape Desk Phone Ip 35g Version-
Atos ≫ Openscape Desk Phone Ip 35g Eco Version-
Atos ≫ Openscape Desk Phone Ip 55g Version-
Atos ≫ Openscape Desk Phone Ip 35g Eco Version-
Atos ≫ Openscape Desk Phone Ip 55g Version-
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.17% | 0.35 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.9 | 1.2 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:N/I:P/A:N
|
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.