295 matches found
CVE-2018-16219: Improper Authentication
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker in the same network as the device to change the admin password without authentication via a POST request...
CVE-2018-5757
An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...
Command injection
An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...
CVE-2018-5757
An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...
CVE-2018-5757
An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...
CVE-2018-5757
AudioCodes 450HD IP Phone devices running firmware 3.0.0.535.106 are affected by CVE-2018-5757. The traceroute and ping functions on the Monitoring page’s web UI pass a user-controllable parameter from a request to command.cgi into an OS command, enabling remote code execution via shell metachara...
CVE-2018-5757: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...
PT-2019-10993
Name of the Vulnerable Software and Affected Versions: AudioCodes 450HD IP Phone version 3.0.0.535.106 Description: An issue was discovered where the traceroute and ping functionality in the Monitoring page of the web UI uses a parameter in a request to command.cgi that unsafely puts user-alterab...
CVE-2018-10091
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...
CVE-2018-10091
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...
CVE-2018-10093
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...
CVE-2018-10093
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...
Cross site scripting
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...
Remote code execution
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...
CVE-2018-10093
AudioCodes IP phones 420HD/400HD running firmware 2.2.12.126 are affected by a remote code execution vulnerability in CGI scripts (notably command.cgi) due to input validation failures. An attacker could execute arbitrary commands on the device, potentially compromising the VoIP network. Remediat...
CVE-2018-10093
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...
CVE-2018-10091
CVE-2018-10091 affects AudioCodes IP phone 420HD devices running firmware 2.2.12.126. The vulnerability is a stored XSS in the CGI interface (mainform.cgi), caused by insufficient input sanitization on user-controllable fields (e.g., Name, Office, Home, Mobile) on the Directory page. Evidence fro...
CVE-2018-10091
AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...