CVE-2019-20029

An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including a...

PT-2021-14136

Name of the Vulnerable Software and Affected Versions: UNIVERGE Aspire WX versions 1.00 through 3.51 UNIVERGE Aspire UX versions 1.00 through 9.70 UNIVERGE SV9100 versions 1.00 through 10.70 SL2100 versions 1.00 through 3.00 Description: The issue allows a remote authenticated attacker to cause a...

CVE-2019-20029

An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including a...

CVE-2019-20027

Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account...

Design/Logic Flaw

An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem...

Default credentials

Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account...

CVE-2019-20032

An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem...

CVE-2019-20032

CVE-2019-20032 affects Aspire-derived NEC PBXes (SV8100, SV9100, SL1100, SL2100). A local attacker who has access to an InMail voicemail box with the find me/follow me feature can reach the system’s administration modem. The case describes no details on the root cause beyond the feature interplay...

CVE-2019-20029

An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including a...

CVE-2019-20028

CVE-2019-20028 affects NEC PBXes running InMail (all SV8100/SV9100/SL1100/SL2100 variants) where the WebPro administration interface allows unauthenticated read-only access to voicemails, greetings, and voice response system content. The root cause is an unauthenticated exposure via WebPro; impac...

PT-2020-10322

Name of the Vulnerable Software and Affected Versions Aspire-derived NEC PBXes versions affected versions not specified SV8100 versions affected versions not specified SV9100 versions affected versions not specified SL1100 versions affected versions not specified SL2100 versions affected versions...

PT-2020-10320

Name of the Vulnerable Software and Affected Versions NEC PBXes versions 7.0 and higher Description The issue concerns NEC PBXes, including the SV8100, SV9100, SL1100, and SL2100, where if incorrectly configured, a blank username and password combination can be entered as a valid account,...

PT-2020-10325

Name of the Vulnerable Software and Affected Versions NEC PBXes versions of SV8100, SV9100, SL1100, and SL2100 Description An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes may access the system's administration modem...

CVE-2019-20028: Undefined Security Weakness

Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's WebPro administration interface...

CVE-2019-20032: Undefined Security Weakness

An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem...

CVE-2019-20027: Improper Authentication

Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account...

CVE-2019-20029: Undefined Security Weakness

An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including a...

NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration

Title: NEC Electra Elite IPK II WebPro 01.03.01 - Session Enumeration Author: Cold z3ro Date: 2020-05-04 Homepage: https://www.0x30.cc/ Vendor Homepage: https://www.nec.com Version: 01.03.01 Discription: NEC SL2100 NEC Electra Elite IPK II WebPro Session Enumeration = $maxproc while pcntlwaitpid0...