Lucene search

MitreCVE-2019-20028

HistoryJul 29, 2020 - 6:15 p.m.

CVE-2019-20028

2020-07-2918:15:13

mitre

web.nvd.nist.gov

cve-2019-20028

nec pbx

inmail software

unauthenticated access

voicemail security

sv8100

sv9100

sl1100

sl2100

webpro administration interface

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system’s WebPro administration interface.

Affected configurations

Nvd

Node

necsv8100_firmware

AND

necsv8100Match-

Node

necsv9100_firmware

AND

necsv9100Match-

Node

necsl1100_firmware

AND

necsl1100Match-

Node

necsl2100_firmware

AND

necsl2100Match-

VendorProductVersionCPE
necsv8100_firmware*cpe:2.3:o:nec:sv8100_firmware:*:*:*:*:*:*:*:*
necsv8100-cpe:2.3:h:nec:sv8100:-:*:*:*:*:*:*:*
necsv9100_firmware*cpe:2.3:o:nec:sv9100_firmware:*:*:*:*:*:*:*:*
necsv9100-cpe:2.3:h:nec:sv9100:-:*:*:*:*:*:*:*
necsl1100_firmware*cpe:2.3:o:nec:sl1100_firmware:*:*:*:*:*:*:*:*
necsl1100-cpe:2.3:h:nec:sl1100:-:*:*:*:*:*:*:*
necsl2100_firmware*cpe:2.3:o:nec:sl2100_firmware:*:*:*:*:*:*:*:*
necsl2100-cpe:2.3:h:nec:sl2100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nec	sv8100_firmware	*	cpe:2.3:o:nec:sv8100_firmware::::::::
nec	sv8100	-	cpe:2.3:h:nec:sv8100:-:::::::*
nec	sv9100_firmware	*	cpe:2.3:o:nec:sv9100_firmware::::::::
nec	sv9100	-	cpe:2.3:h:nec:sv9100:-:::::::*
nec	sl1100_firmware	*	cpe:2.3:o:nec:sl1100_firmware::::::::
nec	sl1100	-	cpe:2.3:h:nec:sl1100:-:::::::*
nec	sl2100_firmware	*	cpe:2.3:o:nec:sl2100_firmware::::::::
nec	sl2100	-	cpe:2.3:h:nec:sl2100:-:::::::*

References

shadytel.su/files/nec_cve.txt

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for CVE-2019-20028