8.3

CVE-2019-12948

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Polycom ≫ Unified Communications Software Version < 5.8.5.1256
   Polycom ≫ C12 Version-
   Polycom ≫ C16 Version-
   Polycom ≫ C8 Version-
   Polycom ≫ Vvx150 Version-
   Polycom ≫ Vvx201 Version-
   Polycom ≫ Vvx250 Version-
   Polycom ≫ Vvx301 Version-
   Polycom ≫ Vvx311 Version-
   Polycom ≫ Vvx350 Version-
   Polycom ≫ Vvx401 Version-
   Polycom ≫ Vvx411 Version-
   Polycom ≫ Vvx450 Version-
   Polycom ≫ Vvx501 Version-
   Polycom ≫ Vvx601 Version-
Polycom ≫ Unified Communications Software Version >= 5.9.3 < 5.9.3.2857
   Polycom ≫ C12 Version-
   Polycom ≫ C16 Version-
   Polycom ≫ C8 Version-
   Polycom ≫ Vvx150 Version-
   Polycom ≫ Vvx201 Version-
   Polycom ≫ Vvx250 Version-
   Polycom ≫ Vvx301 Version-
   Polycom ≫ Vvx311 Version-
   Polycom ≫ Vvx350 Version-
   Polycom ≫ Vvx401 Version-
   Polycom ≫ Vvx411 Version-
   Polycom ≫ Vvx450 Version-
   Polycom ≫ Vvx501 Version-
   Polycom ≫ Vvx601 Version-
Polycom ≫ Unified Communications Software Version >= 6.0.0 < 6.0.0.4839
   Polycom ≫ C12 Version-
   Polycom ≫ C16 Version-
   Polycom ≫ C8 Version-
   Polycom ≫ Vvx150 Version-
   Polycom ≫ Vvx201 Version-
   Polycom ≫ Vvx250 Version-
   Polycom ≫ Vvx301 Version-
   Polycom ≫ Vvx311 Version-
   Polycom ≫ Vvx350 Version-
   Polycom ≫ Vvx401 Version-
   Polycom ≫ Vvx411 Version-
   Polycom ≫ Vvx450 Version-
   Polycom ≫ Vvx501 Version-
   Polycom ≫ Vvx601 Version-
Polycom ≫ United Communications Software Version < 5.9.0
   Polycom ≫ Trio 8500 Version-
   Polycom ≫ Trio 8800 Version-
Polycom ≫ United Communications Software Version < 4.0.14.1580
   Polycom ≫ Soundpoint Ip 300 Version-
   Polycom ≫ Soundpoint Ip 301 Version-
   Polycom ≫ Soundpoint Ip 320 Version-
   Polycom ≫ Soundpoint Ip 321 Version-
   Polycom ≫ Soundpoint Ip 330 Version-
   Polycom ≫ Soundpoint Ip 331 Version-
   Polycom ≫ Soundpoint Ip 335 Version-
   Polycom ≫ Soundpoint Ip 430 Version-
   Polycom ≫ Soundpoint Ip 450 Version-
   Polycom ≫ Soundpoint Ip 500 Version-
   Polycom ≫ Soundpoint Ip 501 Version-
   Polycom ≫ Soundpoint Ip 550 Version-
   Polycom ≫ Soundpoint Ip 560 Version-
   Polycom ≫ Soundpoint Ip 600 Version-
   Polycom ≫ Soundpoint Ip 601 Version-
   Polycom ≫ Soundpoint Ip 650 Version-
   Polycom ≫ Soundpoint Ip 670 Version-
   Polycom ≫ Soundpoint Pro Se-220 Version-
   Polycom ≫ Soundpoint Pro Se-225 Version-
   Polycom ≫ Soundstation Duo Version-
   Polycom ≫ Soundstation Ip 4000 Version-
   Polycom ≫ Soundstation Ip 5000 Version-
   Polycom ≫ Soundstation Ip 6000 Version-
   Polycom ≫ Soundstation Ip 7000 Version-
   Polycom ≫ Soundstation Ip 7000 Video Integration Version-
   Polycom ≫ Soundstation Vtx 1000 Version-
   Polycom ≫ Soundstation2 Version-
   Polycom ≫ Soundstation2 Avaya 2490 Version-
   Polycom ≫ Soundstation2 Direct Connect For Nortel Version-
   Polycom ≫ Soundstation2w Version-
Polycom ≫ Unified Communications Software Version < 5.8.5.1256
   Polycom ≫ Vvx300 Version-
   Polycom ≫ Vvx310 Version-
   Polycom ≫ Vvx400 Version-
   Polycom ≫ Vvx410 Version-
   Polycom ≫ Vvx500 Version-
   Polycom ≫ Vvx600 Version-
Polycom ≫ Unified Communications Software Version >= 5.9.3 < 5.9.3.2857
   Polycom ≫ Vvx300 Version-
   Polycom ≫ Vvx310 Version-
   Polycom ≫ Vvx400 Version-
   Polycom ≫ Vvx410 Version-
   Polycom ≫ Vvx500 Version-
   Polycom ≫ Vvx600 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.19% 0.783
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.3 2.8 5.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-749 Exposed Dangerous Method or Function

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.