CVE-2019-12324: OS Command Injection

Published Jul 22, 2019

Updated

A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.

Affected Software

2 affected components

Akuvox Sp-r50p Firmware=50.0.6.156

Akuvox Sp-r50p

Event History

Jul 22, 2019

CVE Published

via MITRE·03:35 PM

Data Sourced

via MITRE·03:35 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2019-12324?

CVE-2019-12324 is classified as a high severity vulnerability due to its potential for command injection by authenticated attackers.

How do I fix CVE-2019-12324?

To mitigate CVE-2019-12324, update the Akuvox R50P VoIP phone firmware to a version that addresses this vulnerability.

Who is affected by CVE-2019-12324?

CVE-2019-12324 affects users of Akuvox R50P VoIP phones running firmware version 50.0.6.156.

What type of attack does CVE-2019-12324 involve?

CVE-2019-12324 involves a command injection attack due to missing input validation in the logging server configuration.

Can CVE-2019-12324 be exploited remotely?

Yes, CVE-2019-12324 can be exploited by an authenticated attacker on the same network.