PT-2019-12756

Name of the Vulnerable Software and Affected Versions Akuvox R50P VoIP phone version 50.0.6.156 Description The issue concerns hardcoded credentials, which allow an attacker to access the device via telnet. The telnet service runs on port 2323 and cannot be disabled. Additionally, the credentials...

PT-2019-12755

Name of the Vulnerable Software and Affected Versions Akuvox R50P VoIP phone version 50.0.6.156 Description The issue is related to missing file and path validation in the ringtone upload function, allowing an attacker to upload a manipulated ringtone file with an executable payload, such as shel...

CVE-2019-12327: Use of Hard-coded Credentials

Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed...

CVE-2019-12324: Improper Neutralization of Special Elements used in an OS Command

A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...