CVE-2019-12326: Malicious File Upload

Published Jul 22, 2019

Updated

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.

Affected Software

2 affected components

Akuvox Sp-r50p Firmware=50.0.6.156

Akuvox Sp-r50p

Event History

Jul 22, 2019

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2019-12326?

CVE-2019-12326 has a high severity due to the potential for remote code execution through uploaded manipulated ringtone files.

How do I fix CVE-2019-12326?

To mitigate CVE-2019-12326, update the Akuvox R50P VoIP phone firmware to the latest version that addresses this vulnerability.

What type of attack does CVE-2019-12326 enable?

CVE-2019-12326 enables attackers to execute arbitrary code on the device by uploading specially crafted ringtone files.

Which device is affected by CVE-2019-12326?

CVE-2019-12326 affects the Akuvox SP-R50P VoIP phone running firmware version 50.0.6.156.

Is there a known exploit for CVE-2019-12326?

Yes, the vulnerability can be exploited by uploading a malicious ringtone file that contains executable payloads.