CVE-2019-14260

On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in…

published August 1, 2019

CVSS
—
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02803 · 86.4th percentile
Published
2019-08-01T19:15Z
EPSS history
Timeline
  • 01 AUG 19:15Z
    On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in…
    cvelistv5