Command injection

A command injection missing input validation, escaping in the monitoring or memory status web interface in AudioCodes 405HD firmware 2.2.12 VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands like starting telnetd or opening a reverse shell...

Default credentials

A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker in the same network as the device to change the admin password without authentication via a POST request...

CVE-2018-16220

CVE-2018-16220 affects AudioCodes 405HD VoIP phone with firmware 2.2.12. Affected component: the device’s web interface. Root cause: Cross Site Scripting in input fields (domain field and personal settings) that lets an attacker inject JavaScript by manipulating phone book entries or the domain n...

CVE-2018-16219

CVE-2018-16219 concerns AudioCodes 405HD VoIP phone (firmware 2.2.12) where the web interface has missing password verification. This allows a remote attacker on the same network to change the admin password via a POST request without authentication. The issue is documented in standard CVE source...

CVE-2018-16219

A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker in the same network as the device to change the admin password without authentication via a POST request...

CVE-2018-16216

CVE-2018-16216 describes a command-injection in the monitoring or memory status web interface of AudioCodes 405HD VoIP phones (firmware 2.2.12). The root cause is missing input validation/escaping in a POST handler on the device web server, enabling an authenticated remote attacker on the same ne...

CVE-2018-16216

A command injection missing input validation, escaping in the monitoring or memory status web interface in AudioCodes 405HD firmware 2.2.12 VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands like starting telnetd or opening a reverse shell...

CVE-2018-5757

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

Command injection

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

CVE-2018-5757

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

CVE-2018-5757

AudioCodes 450HD IP Phone devices running firmware 3.0.0.535.106 are affected by CVE-2018-5757. The traceroute and ping functions on the Monitoring page’s web UI pass a user-controllable parameter from a request to command.cgi into an OS command, enabling remote code execution via shell metachara...

CVE-2018-5757

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...

CVE-2018-10091

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...

CVE-2018-10093

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...

CVE-2018-10093

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...

CVE-2018-10091

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...

Remote code execution

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...

Cross site scripting

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS...

CVE-2018-10093

AudioCodes IP phones 420HD/400HD running firmware 2.2.12.126 are affected by a remote code execution vulnerability in CGI scripts (notably command.cgi) due to input validation failures. An attacker could execute arbitrary commands on the device, potentially compromising the VoIP network. Remediat...

CVE-2018-10093

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution...