Lucene search

MitreCVE-2021-37145

HistorySep 07, 2021 - 11:15 p.m.

CVE-2021-37145

2021-09-0723:15:07

CWE-77

mitre

web.nvd.nist.gov

cve-2021-37145

command-injection

poly

cx5500

cx5100

privilege escalation

remote code execution

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.002

Percentile

56.8%

JSON

A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and Remote Code Execution capability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected configurations

Nvd

Node

polycx5500_firmwareMatch1.3.5

AND

polycx5500Match-

Node

polycx5100_firmwareMatch1.3.5

AND

polycx5100Match-

VendorProductVersionCPE
polycx5500_firmware1.3.5cpe:2.3:o:poly:cx5500_firmware:1.3.5:*:*:*:*:*:*:*
polycx5500-cpe:2.3:h:poly:cx5500:-:*:*:*:*:*:*:*
polycx5100_firmware1.3.5cpe:2.3:o:poly:cx5100_firmware:1.3.5:*:*:*:*:*:*:*
polycx5100-cpe:2.3:h:poly:cx5100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
poly	cx5500_firmware	1.3.5	cpe:2.3:o:poly:cx5500_firmware:1.3.5:::::::*
poly	cx5500	-	cpe:2.3:h:poly:cx5500:-:::::::*
poly	cx5100_firmware	1.3.5	cpe:2.3:o:poly:cx5100_firmware:1.3.5:::::::*
poly	cx5100	-	cpe:2.3:h:poly:cx5100:-:::::::*

References

support.polycom.com/content/dam/polycom-support/global/documentation/security-bulletin-cx5100-cx5500-authenticated-v1-0.pdf

support.polycom.com/content/support.html

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.002

Percentile

56.8%

JSON

Related for CVE-2021-37145