Lucene search

[email protected]CVE-2019-12948

HistoryJul 29, 2019 - 4:15 p.m.

CVE-2019-12948

2019-07-2916:15:12

CWE-749

[email protected]

web.nvd.nist.gov

cve-2019-12948

vulnerability

web-based management

polycom

dos

authenticated

remote attacker

admin privileges

arbitrary code

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.7%

JSON

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.

Affected configurations

NVD

Node

polycomunified_communications_softwareRange<5.8.5.1256

polycomunified_communications_softwareRange5.9.3–5.9.3.2857

polycomunified_communications_softwareRange6.0.0–6.0.0.4839

AND

polycomc12Match-

polycomc16Match-

polycomc8Match-

polycomvvx150Match-

polycomvvx201Match-

polycomvvx250Match-

polycomvvx301Match-

polycomvvx311Match-

polycomvvx350Match-

polycomvvx401Match-

polycomvvx411Match-

polycomvvx450Match-

polycomvvx501Match-

polycomvvx601Match-

Node

polycomunited_communications_softwareRange<5.9.0

AND

polycomtrio_8500Match-

polycomtrio_8800Match-

Node

polycomunited_communications_softwareRange<4.0.14.1580

AND

polycomsoundpoint_ip_300Match-

polycomsoundpoint_ip_301Match-

polycomsoundpoint_ip_320Match-

polycomsoundpoint_ip_321Match-

polycomsoundpoint_ip_330Match-

polycomsoundpoint_ip_331Match-

polycomsoundpoint_ip_335Match-

polycomsoundpoint_ip_430Match-

polycomsoundpoint_ip_450Match-

polycomsoundpoint_ip_500Match-

polycomsoundpoint_ip_501Match-

polycomsoundpoint_ip_550Match-

polycomsoundpoint_ip_560Match-

polycomsoundpoint_ip_600Match-

polycomsoundpoint_ip_601Match-

polycomsoundpoint_ip_650Match-

polycomsoundpoint_ip_670Match-

polycomsoundpoint_pro_se-220Match-

polycomsoundpoint_pro_se-225Match-

polycomsoundstation_duoMatch-

polycomsoundstation_ip_4000Match-

polycomsoundstation_ip_5000Match-

polycomsoundstation_ip_6000Match-

polycomsoundstation_ip_7000Match-

polycomsoundstation_ip_7000_video_integrationMatch-

polycomsoundstation_vtx_1000Match-

polycomsoundstation2Match-

polycomsoundstation2_avaya_2490Match-

polycomsoundstation2_direct_connect_for_nortelMatch-

polycomsoundstation2wMatch-

Node

polycomunified_communications_softwareRange<5.8.5.1256

polycomunified_communications_softwareRange5.9.3–5.9.3.2857

AND

polycomvvx300Match-

polycomvvx310Match-

polycomvvx400Match-

polycomvvx410Match-

polycomvvx500Match-

polycomvvx600Match-

CPENameOperatorVersion
polycom:unified_communications_softwarepolycom unified communications softwarelt5.8.5.1256
polycom:unified_communications_softwarepolycom unified communications softwarelt5.9.3.2857
polycom:unified_communications_softwarepolycom unified communications softwarelt6.0.0.4839

CPE	Name	Operator	Version
polycom:unified_communications_software	polycom unified communications software	lt	5.8.5.1256
polycom:unified_communications_software	polycom unified communications software	lt	5.9.3.2857
polycom:unified_communications_software	polycom unified communications software	lt	6.0.0.4839

References

support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.7%

JSON

Related for CVE-2019-12948

prion1 nvd1 cvelist1