CVE-2019-12324

A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP…

High · published July 22, 2019

CVSS v3.0
7.2
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.04343 · 91.2th percentile
Published
2019-07-22T15:35Z
EPSS history
Timeline
  • 22 JUL 15:35Z
    A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP…
    cvelistv5