CVE-2019-12326

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone…

High · published July 22, 2019

CVSS v3.0
7.2
EPSS
3%
Percentile
87.2
In the wild
Unconfirmed
What it is

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.02985 · 87.2th percentile
Published
2019-07-22T16:05Z
EPSS history
Timeline
  • 22 JUL 16:05Z
    Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone…
    cvelistv5