CVE-2018-19977
PoC —CVSS 3.0
8.0 high
EPSS
4%p90
Published
()
Modified
Description
A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows an authenticated remote attacker (simple user) -- in the same network as the device -- to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server.
- Vendors
- auerswald
- Products
- comfortel 1200 ip firmware
- Weakness
- CWE-78
- Vector
- CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.