Lucene search

MitreCVE-2019-12948

HistoryJul 29, 2019 - 4:15 p.m.

CVE-2019-12948

2019-07-2916:15:12

CWE-749

mitre

web.nvd.nist.gov

cve-2019-12948

vulnerability

web-based management

polycom

dos

authenticated

remote attacker

admin privileges

arbitrary code

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

64.6%

JSON

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.

Affected configurations

Nvd

Node

polycomunified_communications_softwareRange<5.8.5.1256

polycomunified_communications_softwareRange5.9.3–5.9.3.2857

polycomunified_communications_softwareRange6.0.0–6.0.0.4839

AND

polycomc12Match-

polycomc16Match-

polycomc8Match-

polycomvvx150Match-

polycomvvx201Match-

polycomvvx250Match-

polycomvvx301Match-

polycomvvx311Match-

polycomvvx350Match-

polycomvvx401Match-

polycomvvx411Match-

polycomvvx450Match-

polycomvvx501Match-

polycomvvx601Match-

Node

polycomunited_communications_softwareRange<5.9.0

AND

polycomtrio_8500Match-

polycomtrio_8800Match-

Node

polycomunited_communications_softwareRange<4.0.14.1580

AND

polycomsoundpoint_ip_300Match-

polycomsoundpoint_ip_301Match-

polycomsoundpoint_ip_320Match-

polycomsoundpoint_ip_321Match-

polycomsoundpoint_ip_330Match-

polycomsoundpoint_ip_331Match-

polycomsoundpoint_ip_335Match-

polycomsoundpoint_ip_430Match-

polycomsoundpoint_ip_450Match-

polycomsoundpoint_ip_500Match-

polycomsoundpoint_ip_501Match-

polycomsoundpoint_ip_550Match-

polycomsoundpoint_ip_560Match-

polycomsoundpoint_ip_600Match-

polycomsoundpoint_ip_601Match-

polycomsoundpoint_ip_650Match-

polycomsoundpoint_ip_670Match-

polycomsoundpoint_pro_se-220Match-

polycomsoundpoint_pro_se-225Match-

polycomsoundstation_duoMatch-

polycomsoundstation_ip_4000Match-

polycomsoundstation_ip_5000Match-

polycomsoundstation_ip_6000Match-

polycomsoundstation_ip_7000Match-

polycomsoundstation_ip_7000_video_integrationMatch-

polycomsoundstation_vtx_1000Match-

polycomsoundstation2Match-

polycomsoundstation2_avaya_2490Match-

polycomsoundstation2_direct_connect_for_nortelMatch-

polycomsoundstation2wMatch-

Node

polycomunified_communications_softwareRange<5.8.5.1256

polycomunified_communications_softwareRange5.9.3–5.9.3.2857

AND

polycomvvx300Match-

polycomvvx310Match-

polycomvvx400Match-

polycomvvx410Match-

polycomvvx500Match-

polycomvvx600Match-

VendorProductVersionCPE
polycomunified_communications_software*cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*
polycomc12-cpe:2.3:h:polycom:c12:-:*:*:*:*:*:*:*
polycomc16-cpe:2.3:h:polycom:c16:-:*:*:*:*:*:*:*
polycomc8-cpe:2.3:h:polycom:c8:-:*:*:*:*:*:*:*
polycomvvx150-cpe:2.3:h:polycom:vvx150:-:*:*:*:*:*:*:*
polycomvvx201-cpe:2.3:h:polycom:vvx201:-:*:*:*:*:*:*:*
polycomvvx250-cpe:2.3:h:polycom:vvx250:-:*:*:*:*:*:*:*
polycomvvx301-cpe:2.3:h:polycom:vvx301:-:*:*:*:*:*:*:*
polycomvvx311-cpe:2.3:h:polycom:vvx311:-:*:*:*:*:*:*:*
polycomvvx350-cpe:2.3:h:polycom:vvx350:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
polycom	unified_communications_software	*	cpe:2.3:o:polycom:unified_communications_software::::::::
polycom	c12	-	cpe:2.3:h:polycom:c12:-:::::::*
polycom	c16	-	cpe:2.3:h:polycom:c16:-:::::::*
polycom	c8	-	cpe:2.3:h:polycom:c8:-:::::::*
polycom	vvx150	-	cpe:2.3:h:polycom:vvx150:-:::::::*
polycom	vvx201	-	cpe:2.3:h:polycom:vvx201:-:::::::*
polycom	vvx250	-	cpe:2.3:h:polycom:vvx250:-:::::::*
polycom	vvx301	-	cpe:2.3:h:polycom:vvx301:-:::::::*
polycom	vvx311	-	cpe:2.3:h:polycom:vvx311:-:::::::*
polycom	vvx350	-	cpe:2.3:h:polycom:vvx350:-:::::::*

Rows per page:

1-10 of 541

References

support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

64.6%

JSON

Related for CVE-2019-12948