CVE-2019-12324

Akuvox R50P VoIP phone (firmware 50.0.6.156) has a command-injection flaw in the configuration web interface’s logging-server IP address field. The root cause is missing input validation, allowing shell metacharacters in a POST request to trigger OS commands. Exploitation would require an authent...