CVE-2019-12948 (GCVE-0-2019-12948)

Vulnerability from cvelistv5 – Published: 2019-07-29 15:16 – Updated: 2024-08-04 23:32
VLAI?
Summary
A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:32:55.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-02T20:40:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12948",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf",
              "refsource": "CONFIRM",
              "url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12948",
    "datePublished": "2019-07-29T15:16:41",
    "dateReserved": "2019-06-24T00:00:00",
    "dateUpdated": "2024-08-04T23:32:55.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.8.5.1256\", \"matchCriteriaId\": \"C625E971-506A-45F3-AD61-2070AEB0162F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.9.3\", \"versionEndExcluding\": \"5.9.3.2857\", \"matchCriteriaId\": \"DE3B1B9B-3210-44ED-A5F3-6C9C0C800E33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0.0\", \"versionEndExcluding\": \"6.0.0.4839\", \"matchCriteriaId\": \"33A63BC1-CB87-4C99-9549-B1DEB72BE4CC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:c12:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79199231-6249-4C12-9400-E1351A7E92BC\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:c16:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8DAE9212-F081-49BA-8619-6C8A7D99313B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:c8:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBFC659D-A7DF-458A-8161-2AF95954634E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx150:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1E17290-C123-4A51-AF39-B3BCFCE6FFA3\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx201:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C2D973F-E4CA-4085-AFAF-F3FD48182144\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx250:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"620A47C4-7D4D-4C26-A4F6-E95A414996E0\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx301:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ADD18487-B8DF-42C8-A068-6C7C495485C1\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx311:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3853AB2F-A836-4964-9E93-4D4B46F4A673\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx350:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F28EF6-3F2B-4F0E-8349-F86EF0A65280\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx401:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D822D5C9-8C15-4CE9-AC65-A0C3C76B1F03\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx411:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"70824863-4F2C-4619-B5E1-22C4B41C0ADE\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx450:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4F721F0B-538B-482F-8A59-CFE4E388281F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx501:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D54DCE1-77EE-493A-B1B6-9C1D7C952180\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx601:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"303F10D5-C6AC-4025-88D6-2368E904F327\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.9.0\", \"matchCriteriaId\": \"B5A23ECE-B6DD-4C6F-99C4-3A324947826D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:trio_8500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F43818E9-D3DE-45A7-8667-7B6B16625B97\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:trio_8800:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"48C05AC7-2D6E-4301-B312-EEFF9038EFC0\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.0.14.1580\", \"matchCriteriaId\": \"382C5E71-16F4-4E76-BC22-01D81BE4D618\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"820C5839-7C52-4B88-90DA-C6C21FEFD0A2\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_301:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3D7424D6-2CE0-48A3-AFB0-C5D30819FF8C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_320:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1956CD6A-BF80-4B6F-B07C-311667066BBF\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_321:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D22FD3DF-A86C-41C6-A744-685ED5F6609E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_330:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"44A5EBB0-BBFE-49DE-8D63-7A7AC59E89C2\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_331:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EDA78F69-32BE-4675-A98A-B7FCF40627FB\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_335:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"90416A73-992C-477D-9E0A-1F5170E9F884\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_430:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C73B2DB-06ED-44F5-BCBF-214E3EA74CB8\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_450:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DDD8F2D8-EBD9-41F7-8FED-13B8E827372C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1983CB3C-E88B-4355-9AF3-34F9D103A06A\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_501:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7209DA9E-F392-44D9-A8D7-0403AD483D4F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_550:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8840D5B2-33C8-438C-8C32-6B7702B571D9\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_560:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2B071EF0-9F8D-4841-912F-41B82A43819D\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_600:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B153D064-C831-46AB-BC3C-32601CBDD251\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_601:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B75A9809-5378-4C58-9E5A-909492DD2360\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_650:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF786C93-9283-40BB-8F6E-F2A1527E8513\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_ip_670:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6757D2C2-8010-4EB9-A0B5-564FD8E1D7F7\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_pro_se-220:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"424B0E05-DFAC-4AC0-B079-66136051A94E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundpoint_pro_se-225:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"99B9F4C3-1965-4278-863B-4DDE46C9BFC4\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_duo:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"051C3271-88A0-42E2-8A2F-32DF20B5FF6B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_ip_4000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51B28075-E9F4-41E7-B6DE-222DD5D4A4A6\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_ip_5000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7594DBE-73CA-42F9-9134-F69508BEA110\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_ip_6000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C4FFCAC7-25C9-4640-8B97-7557BB13E07E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_ip_7000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9EE2AC3-483B-43FE-B83F-6E19C1D8AFA8\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_ip_7000_video_integration:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"89ED69EB-7E36-4383-BE2B-BC8FB3F94E3A\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation_vtx_1000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BE5ED780-8889-42F5-8F63-4483E3A56936\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation2:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"14CAD094-E94C-4581-856E-EB132F16F6C4\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation2_avaya_2490:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A04ABECE-F4E0-4F16-8BA1-9B7E86FE144C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation2_direct_connect_for_nortel:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"863AE311-1557-41EC-BBE0-296E25B533E9\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:soundstation2w:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D02DBC31-14D7-484E-A68F-C5F076CB1CA3\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.8.5.1256\", \"matchCriteriaId\": \"C625E971-506A-45F3-AD61-2070AEB0162F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.9.3\", \"versionEndExcluding\": \"5.9.3.2857\", \"matchCriteriaId\": \"DE3B1B9B-3210-44ED-A5F3-6C9C0C800E33\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx300:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A36BDB2-1DB7-4D2F-B8AD-609C010B66A8\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx310:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F09F121C-EBBF-4B31-829F-6B584539EE0D\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A3882D3C-6A93-4AB6-9B51-2D19571FC45C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx410:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"28428904-FFBB-4BEF-ABD2-468D81D675C5\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2A64CAE3-6218-4828-BF53-0D61DF0134DE\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:polycom:vvx600:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"824C0FC8-C91D-4ADE-B105-87C8DD6C3603\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en la interfaz de administraci\\u00f3n basada en web de los tel\\u00e9fonos VVX, Trio, SoundStructure, SoundPoint y SoundStation que ejecutan el software Polycom UC, si se explota, podr\\u00eda permitir que un atacante remoto autenticado con privilegios de administrador cause una condici\\u00f3n de denegaci\\u00f3n de servicio (DoS) o ejecutar c\\u00f3digo arbitrario\"}]",
      "id": "CVE-2019-12948",
      "lastModified": "2024-11-21T04:23:52.900",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 8.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.5}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-07-29T16:15:12.647",
      "references": "[{\"url\": \"https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-749\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-12948\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-07-29T16:15:12.647\",\"lastModified\":\"2024-11-21T04:23:52.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de los tel\u00e9fonos VVX, Trio, SoundStructure, SoundPoint y SoundStation que ejecutan el software Polycom UC, si se explota, podr\u00eda permitir que un atacante remoto autenticado con privilegios de administrador cause una condici\u00f3n de denegaci\u00f3n de servicio (DoS) o ejecutar c\u00f3digo arbitrario\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-749\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.8.5.1256\",\"matchCriteriaId\":\"C625E971-506A-45F3-AD61-2070AEB0162F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9.3\",\"versionEndExcluding\":\"5.9.3.2857\",\"matchCriteriaId\":\"DE3B1B9B-3210-44ED-A5F3-6C9C0C800E33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.0.4839\",\"matchCriteriaId\":\"33A63BC1-CB87-4C99-9549-B1DEB72BE4CC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:c12:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79199231-6249-4C12-9400-E1351A7E92BC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:c16:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DAE9212-F081-49BA-8619-6C8A7D99313B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:c8:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBFC659D-A7DF-458A-8161-2AF95954634E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx150:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1E17290-C123-4A51-AF39-B3BCFCE6FFA3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx201:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C2D973F-E4CA-4085-AFAF-F3FD48182144\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx250:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"620A47C4-7D4D-4C26-A4F6-E95A414996E0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx301:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADD18487-B8DF-42C8-A068-6C7C495485C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx311:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3853AB2F-A836-4964-9E93-4D4B46F4A673\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx350:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F28EF6-3F2B-4F0E-8349-F86EF0A65280\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx401:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D822D5C9-8C15-4CE9-AC65-A0C3C76B1F03\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx411:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70824863-4F2C-4619-B5E1-22C4B41C0ADE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx450:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F721F0B-538B-482F-8A59-CFE4E388281F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx501:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D54DCE1-77EE-493A-B1B6-9C1D7C952180\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx601:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"303F10D5-C6AC-4025-88D6-2368E904F327\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.9.0\",\"matchCriteriaId\":\"B5A23ECE-B6DD-4C6F-99C4-3A324947826D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:trio_8500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F43818E9-D3DE-45A7-8667-7B6B16625B97\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:trio_8800:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48C05AC7-2D6E-4301-B312-EEFF9038EFC0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:united_communications_software:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.0.14.1580\",\"matchCriteriaId\":\"382C5E71-16F4-4E76-BC22-01D81BE4D618\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"820C5839-7C52-4B88-90DA-C6C21FEFD0A2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_301:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D7424D6-2CE0-48A3-AFB0-C5D30819FF8C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_320:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1956CD6A-BF80-4B6F-B07C-311667066BBF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_321:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D22FD3DF-A86C-41C6-A744-685ED5F6609E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_330:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44A5EBB0-BBFE-49DE-8D63-7A7AC59E89C2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_331:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EDA78F69-32BE-4675-A98A-B7FCF40627FB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_335:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90416A73-992C-477D-9E0A-1F5170E9F884\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_430:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C73B2DB-06ED-44F5-BCBF-214E3EA74CB8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_450:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDD8F2D8-EBD9-41F7-8FED-13B8E827372C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1983CB3C-E88B-4355-9AF3-34F9D103A06A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_501:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7209DA9E-F392-44D9-A8D7-0403AD483D4F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_550:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8840D5B2-33C8-438C-8C32-6B7702B571D9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_560:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B071EF0-9F8D-4841-912F-41B82A43819D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_600:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B153D064-C831-46AB-BC3C-32601CBDD251\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_601:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B75A9809-5378-4C58-9E5A-909492DD2360\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_650:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF786C93-9283-40BB-8F6E-F2A1527E8513\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_ip_670:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6757D2C2-8010-4EB9-A0B5-564FD8E1D7F7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_pro_se-220:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"424B0E05-DFAC-4AC0-B079-66136051A94E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundpoint_pro_se-225:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"99B9F4C3-1965-4278-863B-4DDE46C9BFC4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_duo:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"051C3271-88A0-42E2-8A2F-32DF20B5FF6B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_ip_4000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51B28075-E9F4-41E7-B6DE-222DD5D4A4A6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_ip_5000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7594DBE-73CA-42F9-9134-F69508BEA110\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_ip_6000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4FFCAC7-25C9-4640-8B97-7557BB13E07E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_ip_7000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9EE2AC3-483B-43FE-B83F-6E19C1D8AFA8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_ip_7000_video_integration:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89ED69EB-7E36-4383-BE2B-BC8FB3F94E3A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation_vtx_1000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE5ED780-8889-42F5-8F63-4483E3A56936\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14CAD094-E94C-4581-856E-EB132F16F6C4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation2_avaya_2490:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A04ABECE-F4E0-4F16-8BA1-9B7E86FE144C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation2_direct_connect_for_nortel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"863AE311-1557-41EC-BBE0-296E25B533E9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:soundstation2w:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D02DBC31-14D7-484E-A68F-C5F076CB1CA3\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.8.5.1256\",\"matchCriteriaId\":\"C625E971-506A-45F3-AD61-2070AEB0162F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:polycom:unified_communications_software:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9.3\",\"versionEndExcluding\":\"5.9.3.2857\",\"matchCriteriaId\":\"DE3B1B9B-3210-44ED-A5F3-6C9C0C800E33\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx300:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A36BDB2-1DB7-4D2F-B8AD-609C010B66A8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx310:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F09F121C-EBBF-4B31-829F-6B584539EE0D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3882D3C-6A93-4AB6-9B51-2D19571FC45C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx410:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28428904-FFBB-4BEF-ABD2-468D81D675C5\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A64CAE3-6218-4828-BF53-0D61DF0134DE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:polycom:vvx600:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"824C0FC8-C91D-4ADE-B105-87C8DD6C3603\"}]}]}],\"references\":[{\"url\":\"https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.