PoC Index

CVE-2019-14260

HIGH 8.0EPSS 2.8%

On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13, a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.

CVSS v3.0
8.0 HIGHCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
7.7 HIGHAV:A/AC:L/Au:S/C:C/I:C/A:C
EPSS
2.80% chance of exploitation in the next 30 days, 85th percentile
Published
2019-08-01
Updated
2024-08-05

Proof-of-concept exploits (1)

References

Related