CVE-2019-12328

A command injection missing input validation issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request...

CVE-2019-12327

Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed...

Command injection

A command injection missing input validation issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request...

Hardcoded credentials

Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed...

CVE-2019-12328

A command injection missing input validation issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request...

CVE-2019-12328

CVE-2019-12328 affects the ATCOM A10W VoIP phone (firmware 2.6.1a2421). The web interface’s remote phonebook configuration URI is vulnerable to command injection via shell metacharacters in a POST request, enabling an authenticated remote attacker on the same network to trigger OS commands. Affec...

CVE-2019-12327

Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed...

CVE-2019-12327

Summary: CVE-2019-12327 affects Akuvox R50P VoIP phone (version 50.0.6.156). The issue arises from hardcoded credentials, enabling an attacker to access the device via telnet on port 2323. The telnet service cannot be turned off and credentials cannot be changed, per the provided sources. Affecte...

CVE-2019-12326

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload shell commands within the file and trigger code execution...

Input validation

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload shell commands within the file and trigger code execution...

CVE-2019-12325

The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device DoS without authentication or execute code authenticated as a user to spawn a remote shell as a root user...

CVE-2019-12324

A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...

Buffer overflow

The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device DoS without authentication or execute code authenticated as a user to spawn a remote shell as a root user...

Command injection

A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...

CVE-2019-12326

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload shell commands within the file and trigger code execution...

CVE-2019-12326

The CVE-2019-12326 issue affects the Akuvox R50P VoIP phone (version 50.0.6.156). The vulnerability arises from missing file and path validation in the ringtone upload function, enabling an attacker to upload a manipulated ringtone file that contains an executable payload and trigger code executi...

CVE-2019-12325

The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device DoS without authentication or execute code authenticated as a user to spawn a remote shell as a root user...

CVE-2019-12325

The CVE-2019-12325 entry concerns the Htek UC902 VoIP phone, specifically the web management interface in firmware 2.0.4.4.46, which has buffer overflow vulnerabilities. The documented impact includes the ability to crash the device (DoS) without authentication or to execute code (authenticated a...

CVE-2019-12324

A command injection missing input validation issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters i...

CVE-2019-12324

Akuvox R50P VoIP phone (firmware 50.0.6.156) has a command-injection flaw in the configuration web interface’s logging-server IP address field. The root cause is missing input validation, allowing shell metacharacters in a POST request to trigger OS commands. Exploitation would require an authent...