ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2019-14259

PoC —
CVSS 3.0
8.0 high
EPSS
3%p86
Published
()
Modified
Description

On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

Vendors
polycom
Products
obihai obi1022 firmware
Weakness
CWE-78
Vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news

No ingested article mentions this CVE yet.