8.3

CVE-2019-12948

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Polycom ≫ Unified Communications Software Version < 5.8.5.1256
   Polycom ≫ C12 Version -
   Polycom ≫ C16 Version -
   Polycom ≫ C8 Version -
   Polycom ≫ Vvx150 Version -
   Polycom ≫ Vvx201 Version -
   Polycom ≫ Vvx250 Version -
   Polycom ≫ Vvx301 Version -
   Polycom ≫ Vvx311 Version -
   Polycom ≫ Vvx350 Version -
   Polycom ≫ Vvx401 Version -
   Polycom ≫ Vvx411 Version -
   Polycom ≫ Vvx450 Version -
   Polycom ≫ Vvx501 Version -
   Polycom ≫ Vvx601 Version -
Polycom ≫ Unified Communications Software Version >= 5.9.3 < 5.9.3.2857
   Polycom ≫ C12 Version -
   Polycom ≫ C16 Version -
   Polycom ≫ C8 Version -
   Polycom ≫ Vvx150 Version -
   Polycom ≫ Vvx201 Version -
   Polycom ≫ Vvx250 Version -
   Polycom ≫ Vvx301 Version -
   Polycom ≫ Vvx311 Version -
   Polycom ≫ Vvx350 Version -
   Polycom ≫ Vvx401 Version -
   Polycom ≫ Vvx411 Version -
   Polycom ≫ Vvx450 Version -
   Polycom ≫ Vvx501 Version -
   Polycom ≫ Vvx601 Version -
Polycom ≫ Unified Communications Software Version >= 6.0.0 < 6.0.0.4839
   Polycom ≫ C12 Version -
   Polycom ≫ C16 Version -
   Polycom ≫ C8 Version -
   Polycom ≫ Vvx150 Version -
   Polycom ≫ Vvx201 Version -
   Polycom ≫ Vvx250 Version -
   Polycom ≫ Vvx301 Version -
   Polycom ≫ Vvx311 Version -
   Polycom ≫ Vvx350 Version -
   Polycom ≫ Vvx401 Version -
   Polycom ≫ Vvx411 Version -
   Polycom ≫ Vvx450 Version -
   Polycom ≫ Vvx501 Version -
   Polycom ≫ Vvx601 Version -
Polycom ≫ United Communications Software Version < 5.9.0
   Polycom ≫ Trio 8500 Version -
   Polycom ≫ Trio 8800 Version -
Polycom ≫ United Communications Software Version < 4.0.14.1580
   Polycom ≫ Soundpoint Ip 300 Version -
   Polycom ≫ Soundpoint Ip 301 Version -
   Polycom ≫ Soundpoint Ip 320 Version -
   Polycom ≫ Soundpoint Ip 321 Version -
   Polycom ≫ Soundpoint Ip 330 Version -
   Polycom ≫ Soundpoint Ip 331 Version -
   Polycom ≫ Soundpoint Ip 335 Version -
   Polycom ≫ Soundpoint Ip 430 Version -
   Polycom ≫ Soundpoint Ip 450 Version -
   Polycom ≫ Soundpoint Ip 500 Version -
   Polycom ≫ Soundpoint Ip 501 Version -
   Polycom ≫ Soundpoint Ip 550 Version -
   Polycom ≫ Soundpoint Ip 560 Version -
   Polycom ≫ Soundpoint Ip 600 Version -
   Polycom ≫ Soundpoint Ip 601 Version -
   Polycom ≫ Soundpoint Ip 650 Version -
   Polycom ≫ Soundpoint Ip 670 Version -
   Polycom ≫ Soundpoint Pro Se-220 Version -
   Polycom ≫ Soundpoint Pro Se-225 Version -
   Polycom ≫ Soundstation Duo Version -
   Polycom ≫ Soundstation Ip 4000 Version -
   Polycom ≫ Soundstation Ip 5000 Version -
   Polycom ≫ Soundstation Ip 6000 Version -
   Polycom ≫ Soundstation Ip 7000 Version -
   Polycom ≫ Soundstation Ip 7000 Video Integration Version -
   Polycom ≫ Soundstation Vtx 1000 Version -
   Polycom ≫ Soundstation2 Version -
   Polycom ≫ Soundstation2 Avaya 2490 Version -
   Polycom ≫ Soundstation2 Direct Connect For Nortel Version -
   Polycom ≫ Soundstation2w Version -
Polycom ≫ Unified Communications Software Version < 5.8.5.1256
   Polycom ≫ Vvx300 Version -
   Polycom ≫ Vvx310 Version -
   Polycom ≫ Vvx400 Version -
   Polycom ≫ Vvx410 Version -
   Polycom ≫ Vvx500 Version -
   Polycom ≫ Vvx600 Version -
Polycom ≫ Unified Communications Software Version >= 5.9.3 < 5.9.3.2857
   Polycom ≫ Vvx300 Version -
   Polycom ≫ Vvx310 Version -
   Polycom ≫ Vvx400 Version -
   Polycom ≫ Vvx410 Version -
   Polycom ≫ Vvx500 Version -
   Polycom ≫ Vvx600 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.73% 0.746
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.3 2.8 5.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-749 Exposed Dangerous Method or Function

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf
Vendor Advisory