CVE-2018-16219

A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the device) to change the admin password without authentication via a POST request.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

3.3 LOWAV:A/AC:L/Au:N/C:N/I:P/A:N

EPSS

1.22% chance of exploitation in the next 30 days, 66th percentile

Published

2019-04-25

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_AudioCodes_405HD.pdf

References

• CVE Record
• NVD entry

Related

• CVE-2018-16216
• CVE-2018-16233
• CVE-2018-16210
• CVE-2018-16247
• CVE-2018-16167
• CVE-2018-16252